security Utility

PDF Forensic Inspector — Deep Object X-Ray & Preflight Analyzer

Perform comprehensive forensic preflight and security audits on any PDF file directly in your browser. Inspect embedded font subsets, image color spaces (CMYK vs RGB), hidden incremental save revisions, active JavaScript or launch hooks, and decompressed page content streams with zero server uploads.

Drop PDF here for Forensic X-Ray & Object Preflight

Deeply inspect embedded font subsets, image color spaces (CMYK vs RGB), incremental save revisions, active JavaScript, and raw decompressed streams.

100% In-Browser Forensic Sandbox • Zero Cloud Leaks • Preflight Audit

Version & Revision Scan • Font Subsets • Prepress CMYK/RGB • Active Payload Detection

%PDF-1.7

specimen.pdf

0 KB • 0 pages • 0 indirect objects

✓

Clean PDF — No Active Code Found

No embedded JavaScript, launch triggers, or attachments detected.

Single-Pass Original PDF

Contains 1 trailer block. No incremental updates detected.

Producer —

Creator —

Created Date —

Encrypted No

AcroForm Interactive No

Digital Signatures No

Indirect Object Map Distribution

Font Name	Subtype	Subset Status	Embedding Status
No embedded fonts detected.

Dimensions	Color Space	Bit Depth	Compression Filter	Prepress Status
No embedded raster images detected.

How to use PDF Forensic Inspector — Deep Object X-Ray & Preflight Analyzer

Upload PDF Specimen

Drop in any PDF contract, court evidence, preprint artwork, or suspicious document to start deep forensic analysis.

Review Security & Revision Audit

Examine incremental edit revisions, check for hidden active JavaScript, malicious launch actions, and encryption state.

Inspect Fonts & Prepress Color Spaces

Audit embedded font subsets, identify missing fonts, and verify whether images are in print-ready CMYK or digital RGB.

X-Ray Decompressed Content Streams

View syntax-highlighted raw PDF drawing operators (BT/ET, Tf, Tj, cm, Do) and export a complete forensic JSON diagnostic report.

Professional Preflight & Forensic Diagnostics — 100% Free & In-Browser

Enterprise preflight software like Enfocus PitStop Pro charges upwards of $750/year, and Adobe Acrobat Pro Preflight requires a $239/year recurring subscription. Forensic analysts, commercial print shops, legal teams, and cyber researchers shouldn’t have to pay enterprise ransoms or compromise data privacy just to see what is secretly inside a PDF.

AirPDF’s PDF Forensic Inspector & Deep Object X-Ray brings institutional-grade PDF preflight and binary object auditing right to your browser with zero installation and zero cloud leaks.

Key Forensic Capabilities

Incremental Revision & History Detection: Reveals whether a PDF is an original single-pass export or has undergone multiple incremental saves that may conceal older redactions or modified contract clauses.
Malicious Hook & Active Content Scanner: Audits the PDF catalog for executable JavaScript (/JS, /JavaScript), external process triggers (/Launch), automated form submissions, and embedded attachment payloads (/EmbeddedFiles).
Prepress Font & Color Space Auditing: Verifies whether fonts are properly subset-embedded ([A-Z]{6}+FontName) and whether photographs and illustrations meet offset print criteria (DeviceCMYK) vs digital displays (DeviceRGB).
Decompressed Page Stream Terminal: Inflates FlateDecode page streams in real time, displaying the raw vector and typography instructions with instant one-click copying and forensic JSON export.

Frequently Asked Questions

What is an incremental PDF revision? ▼

When a PDF is edited or digitally signed using Adobe Acrobat or standard software, previous versions of objects are often preserved rather than deleted. The application appends new xref tables and '%%EOF' markers at the end of the file. AirPDF's Forensic Inspector counts these revision blocks, alerting you if a document was silently modified after initial creation.

Why do I need to inspect embedded fonts? ▼

Commercial print shops require all fonts to be 100% embedded (either full sets or subsets with unique 6-character prefixes like 'ABCDEF+Helvetica'). If a font is un-embedded, the physical printing press will substitute a system fallback font, distorting your kerning, page breaks, and layout.

How does the security scan detect malicious PDF payloads? ▼

Hackers sometimes conceal exploit payloads inside PDF dictionaries using '/JavaScript', '/JS', '/Launch', or '/EmbeddedFiles' action hooks that execute scripts or launch executables when a victim opens the file. AirPDF parses the binary dictionary tree and flags any active content hooks.

Can I inspect image color spaces for prepress printing? ▼

Yes! High-end commercial prepress requires DeviceCMYK images for offset CMYK 4-color printing presses. Web PDFs usually contain DeviceRGB or sRGB. Our preflight engine scans every indirect image XObject, detailing its pixel resolution, color space, bit depth, and compression algorithm.

Can I see the raw decompressed PDF content stream? ▼

Yes. PDF page text and vector commands are compressed using zlib / FlateDecode. AirPDF instantly inflates the underlying byte stream, exposing the true PostScript-style PDF drawing operators (q/Q state, cm transformation matrices, BT/ET text blocks, and Tj glyph strings) with one-click copy.

Are my confidential contracts or forensic files uploaded anywhere? ▼

Never. AirPDF operates completely client-side in your local browser sandbox. Your PDF bytes, metadata, and object databases are processed entirely in browser memory without sending a single byte across the internet.