Pdf metadata inaccuracies

[johnno224]

Wondering if anyone can help with a pdf metadata issue I’m having. I am trying to work out if a pdf document has been edited recently, and I can see from the metadata that the create_date attribute is 2011 and the producer attribute is LibreOffice 7.2, which was not released until 2021. Can there be a reasonable explanation for this or is it a sign that the document has been edited recently - i.e. tampered with but made to look like it was created in 2011? Some possibilities to rule out:

• Would opening a 2011 document in 2024 cause the producer to update if say, the document has to be converted to 2024 specifications? In this case I’d probably expect the create date to update too?
• Could there be a bug in 7.2 whereby the producer is mistakenly updated when it’s opened
• Could there be a bug in 7.2 whereby the producer is updated correctly when opened but the create date isn’t.

Thanks!

[Wanderer]

@johnno224

Can there be a reasonable explanation for this

Without testing: The creation date may not be for the pdf, but for the original document, wich was converted to pdf later.
.
I’m usually not checking this dates, but I’ve sometimes seen persons as “author” in metadata, wich are impossible. Explanation: They created the templates still in use to create new letters etc. and this carries forward, if one is not checking carefully …
.

@johnno224

In this case I’d probably expect

Never expect to much and especially : There are no laws on this and no enforcement to work “by the docs”. You have to check every case.
.

@johnno224

tampered with but made to look like

IMHO the only way to detect this is digitally signing the file and access to the public key to check. Another way are checksums, but as MD5 shows this is not always reliable over time…

[johnno224]

Thanks @Wanderer, great points. The date is 7 seconds after the corresponding document it’s been created from, which to me suggest a workflow of saving the original document then immediately creating the PDF.

[johnno224]

“I’m usually not checking this dates, but I’ve sometimes seen persons as “author” in metadata, wich are impossible. Explanation: They created the templates still in use to create new letters etc. and this carries forward, if one is not checking carefully …”

It’s the producer attribute in this case, i.e. the software used to create the PDF. If it was done from a template (which is possible), then that template must have been created after office 7.2 was released and hence so must any documents created using it.

[Wanderer]

@Wanderer

Without testing

Tested LO 6.4 and 7.4
In both cases I get todays date and time when generating a PDF from a 5 years old .odt via Writer/GUI

[johnno224]

@Wanderer really appreciate your help on this, thank you. It would have been a .doc file I think but that shouldn’t make a difference.

If I’m interpreting your comment correctly then, it supports the theory (but doesn’t necessarily prove) that something untoward may have gone on here and the 2011 date cannot necessarily be trusted.

Thanks!