DocForensic

Document Origin Identifier

Identify what likely created a PDF - Word, Acrobat, a scanner, a screenshot tool - from its metadata, fonts, and internal structure, with a confidence score.

This tool combines several independent signals - Producer/Creator and XMP toolkit strings, font-embedding patterns, object-stream and page structure, and scan/screenshot detection - into a best-effort guess at what produced a PDF, with a confidence score. When signals genuinely disagree (for example, a document created in one tool and later modified in another), it reports a "Mixed origin" verdict rather than forcing a single answer. It only reads the file; nothing is changed.

Simple workflow

How it works

  1. 1

    Add PDFs

    Add one or more PDFs to the list.

  2. 2

    Identify

    Run identification on a file and open its origin profile.

  3. 3

    Review

    Inspect the signal breakdown and export a report.

Frequently asked questions

Does this prove who created a document?

No. Every signal here is a heuristic based on common, well-known patterns - Producer/Creator strings can be spoofed or stripped, and font/structure fingerprints describe typical behavior, not a guarantee. Treat the result as an investigative lead, not a proof of authorship.

What does "Mixed origin" mean?

It means the signals disagree in a way that suggests the document was created in one tool and later modified or re-exported by another - for example, structural or font patterns pointing to one generator while the Producer string names a different one. Both are reported so you can judge the sequence yourself.

Does this identify the exact scanner make and model?

Only when the scanning software or hardware names itself in the Producer/Creator metadata, which many scanners do. It does not parse embedded ICC color profiles for device identification.

Stay ahead of your document work

New tools and thoughtful product updates, delivered occasionally. No noise, no spam.