Can You See the Edit History of a PDF? What the File Keeps

The short answer

Usually not. A PDF is not like Google Docs: it has no built-in log of who changed what and when. What you can find depends on how the file was saved and where it has been.

You can usually see when the file says it was created and last modified. You can sometimes recover an earlier version, because some edits are added to the end of the file and the old content stays inside. And you get a real version history only if the file lived in a service that keeps one, such as Google Drive, Dropbox or SharePoint. That history belongs to the service, not the PDF.

See when a PDF was last modified

In Acrobat or Reader, open File, then Properties, and read the Description tab. On a Mac in Preview, open Tools, then Show Inspector. You will usually see a created date, a modified date and the application that made the file.

If the modified date is later than the created date, the file probably changed after it was made, though something as ordinary as saving a filled form can do that. It will not tell you what changed or who changed it. And both dates are text inside the file, so they can be rewritten.

• How to tell if a PDF has been edited or backdated Five checks for a PDF you do not trust.

Look for earlier versions inside the file

Many PDF edits are incremental saves: the new content is added to the end, and the original stays in the file. A viewer shows the latest version, but the older bytes are still there. Each save normally ends with a marker, %%EOF, so counting them shows how many times the file was saved this way.

We tested this on a small PDF. After we changed its account number with an incremental save, the file had two markers. Cutting it just after the first marker gave back a file identical, byte for byte, to the original, with the old number in it. To do the same, make a copy, list the markers, add 6 to the first number and cut there.

Two cautions. A second marker does not always mean an edit, because a PDF optimized for the web has two from the start. And if the file is digitally signed, you may not need any of this: Acrobat's Signature panel can open the version that was signed.

# Show where each save ends
LC_ALL=C grep -abo "%%EOF" contract.pdf
# 552:%%EOF
# 739:%%EOF

# Cut after the first marker: 552 + 6 = 558
head -c 558 contract.pdf > previous.pdf

Check the service it came from

If the file sat in a cloud service, that is where the real history is. In Google Drive, right-click the file and look for its version history or Manage versions. Dropbox, OneDrive and SharePoint have their own version history views.

Those histories have limits. Google says older versions may be deleted after 30 days or once there are 100 newer ones, unless you mark a version to keep forever. Other services set their own limits by plan. The history stays with the service too: once someone downloads the file and emails it to you, your copy has none of it.

• Google Drive: check activity and file versions How versions are shown and how long they are kept.

Compare two copies

If you hold two versions, you can skip the detective work. Hash both files: if the fingerprints match, they are the same file to the byte. If they differ, a comparison tool such as Acrobat Pro's Compare Files can show what changed on the page.

Fingerprints can differ even when the pages look identical, because re-saving a file changes its bytes without changing its text. So a difference tells you the files are not the same file, and you then look at the content to see whether anything that matters has changed.

# Mac or Linux
shasum -a 256 version-a.pdf version-b.pdf

# Windows PowerShell
Get-FileHash version-a.pdf, version-b.pdf

Why a clean file proves nothing

Everything above can catch an edit. None of it can clear a file. When we re-saved the edited test file with a free command-line tool, the second marker and the old account number both disappeared, leaving one tidy file with no sign of the change. Printing a PDF to a new PDF has a similar effect.

So one marker, matching dates and no version history do not show a PDF was never edited. They only show that this file carries no trace of an edit. The same goes for metadata tools: ExifTool warns that its PDF edits are reversible because it adds them as an incremental update, and a clean rewrite removes that trail too.

Keep a history for documents that matter

A PDF will not keep its own history, so for documents you issue, you have to keep one beside it. Record each version when it leaves your hands, and you have a list of exactly which files existed and when, with nothing to dig out of the file later.

That is what Document Anchor does. Drop each version in the dashboard, give it a reference such as Lease v3 or Invoice 1042 corrected, and your browser hashes the file. Invoance signs that fingerprint with your organization's key and records the time. The file stays with you unless you choose to store it. Later, anyone holding a copy can drop it on the proof page and see whether it matches, with no account.

It is a history of versions, not a list of edits. It will not show you which words changed between v2 and v3, and it only covers versions you recorded.

• How to prove a document existed on a certain date How the options compare, and what a record shows.