Learn
Plain-language guides to document forensics. No jargon without an explanation.
How to tell if a PDF was modified
The signals that show a PDF changed after it was made, and which ones you can trust.
What a digital signature actually proves
Digital signatures prove some things with math and nothing else. Here is the line.
PDF metadata, explained
Creation dates, producers, and edit history: what PDF metadata records and how it lies.
Why converted PDFs lose their history
Online converters and print-to-PDF rebuild the file. What that erases and what it leaves.
Reading a DocVerdict report
Verified checks versus observations, and how to act on each one.
How to spot a fake pay stub
The math checks and file-level checks that catch altered pay stubs in minutes.
How to verify a bank statement PDF
What a genuine bank PDF looks like at the file level, and the fastest way to check one.
A landlord's guide to verifying applicant documents
A ten-minute screening routine for pay stubs, statements, and employment letters.
How to verify an offer or employment letter
What the file can tell you, and the two checks that actually settle it.
Altered invoices: how to catch them
Invoice fraud usually changes one field: the bank details. The checks that catch it before payment.
Verifying certificates of insurance
How to check a COI's file, and why the carrier callback is the only real proof of coverage.
Checking transcripts and certificates
What registrar-issued files look like, and how to check a credential document.
What is an incremental update in a PDF?
PDF edits get appended over the original. Why that design is a gift to document examiners.
Can PDF metadata be faked?
Yes, every field. What that means, and which evidence survives when metadata can't be trusted.
How to find out who created a PDF
Author fields, software fingerprints, and document IDs, and how far each can take you.
PDF modified date before creation date: what it means
The innocent explanations, the suspicious one, and how to tell them apart.
AI-generated documents: what you can actually verify
AI text detectors don't work reliably. Provenance does. A practical guide for the new normal.
What the PDF producer field reveals
The single most useful metadata field in document checking, and how to read it.
Microsoft Print to PDF in metadata: what it means
The file was reprinted on someone's computer. What that erases and when it matters.
Can a PDF be used as evidence in court?
Authentication rules for electronic documents, in plain language.
What EXIF data actually records
Every photo carries a hidden record: when it was taken, on what camera, sometimes where. What EXIF stores, what strips it, and how far to trust it.
How to tell if a photo was edited
Edited photos usually look perfect. The evidence lives in the file: software traces, timestamp gaps, and metadata that doesn't fit the photo's story.
What GPS data in photos reveals
Phones write location into photos by default. What GPS metadata shows, when it matters as evidence, and how to protect your own location when sharing.
Why screenshots and messaging apps strip photo metadata
A photo that traveled through WhatsApp, iMessage, or a screenshot arrives with no history. Why that happens and what it means when the photo is evidence.
Verifying insurance and damage photos
Damage photos drive claims, deposits, and disputes, and they're easy to recycle or mistime. The file-level checks that anchor a photo to a time and place.
Two versions of one contract: how to tell which is real
When two copies of the same document disagree, the files usually contain the answer: which one descends from which, and what changed between them.
What document descent means
A PDF edited the normal way contains its own ancestor. Why appended bytes prove which file came first, and where the proof has limits.
Handling a document version dispute
Someone's copy of the agreement doesn't match yours. The steps that preserve your evidence and settle the sequence before the dispute hardens.
How to read email headers in plain language
Every email carries a routing record of where it really came from and how it traveled. How to read the headers that matter and skip the ones that don't.
What SPF, DKIM, and DMARC results mean
The three authentication checks recorded on every email you receive, what pass and fail actually tell you, and the limits nobody mentions.
How to save an email as a .eml file
Gmail, Outlook, and Apple Mail can all export a message as a .eml file with its full headers intact. The exact steps for each, and why it matters.
Spotting payment-redirect emails
The most expensive email fraud is a quiet one: new bank details from a familiar sender. The header and file checks that catch it before the wire goes out.
Why Reply-To mismatches matter
The From line is what you see; Reply-To is where your answer actually goes. Why the gap between them is one of email's most reliable warning signs.
Wire fraud at closing: verifying instructions before money moves
Closing funds vanish when buyers wire to instructions from a compromised email thread. The verification routine for buyers, agents, and title companies.
The bookkeeper's check for vendor bank-detail changes
Payment-redirect requests arrive as routine emails from real vendor threads. A five-minute verification routine for accounts-payable teams.
Business email compromise: warning signs in the message itself
BEC messages read perfectly because they come from real threads. The technical records that expose them, and how to read the signs without being an admin.
Verifying proof of income beyond pay stubs
Gig workers, freelancers, and the self-employed don't have pay stubs. What income documents to ask for instead, and how to check the files they send.
What to do when you suspect a document was altered
Keep the file, check its records, request the original, and document everything. The sequence that protects you whether the suspicion is right or wrong.
How to check whether a PDF is what it claims to be
A plain checklist for examining a PDF you don't trust: signature status, changes after signing, and what the metadata reveals, with the limits of each.
How to verify a signed contract PDF
Before you rely on a signed contract, check whether the signature is real, whether it covers the whole document, and whether anything was added after signing.
How to spot a fake utility bill or proof of address
Utility bills are the most edited proof-of-address document. What a genuine bill's file looks like, the edits that betray a fake, and how to confirm.
How to verify a proof of funds letter
A proof of funds letter decides whether an offer is real. What a genuine letter's file shows, the edits that fake balances leave behind, and how to confirm.