Learn

What document descent means

Descent is the strongest claim one can make about two versions of a document: not just that they differ, but that one was made from the other. With PDFs, descent is often provable from structure alone, and understanding why takes one paragraph of how the format works.

The mechanism

PDF supports incremental saving: instead of rewriting a file, tools append the changed objects and a new index to the end, leaving every original byte in place. A file edited this way is its ancestor plus a tail of changes. So when file B's opening bytes are exactly file A, all of A, byte for byte, followed by additional content, B descends from A as a matter of arithmetic. The relationship can chain across generations, and each appended generation carries its own timestamps and signatures, which is how a comparison reconstructs not just order but a timeline of the document's life.

Why it's strong evidence

Descent can't run backward. A cannot contain B's later changes; the containment has one direction, so the sequence is settled the way a fossil layer settles age. It survives renaming, emailing, and copying, none of which touch the bytes. And it pairs decisively with signatures: when the appended content sits after a signature's covered span, the file proves that someone changed the document after it was signed, while the signature itself still verifies on what it originally covered.

Where it has limits

A full rewrite breaks the chain: some editors save complete new files, and any conversion or print-to-PDF rebuilds from scratch, producing a document with the same appearance and no lineage. So absence of descent never proves independence; it proves only that the bytes don't carry the relationship. And descent proves sequence, not legitimacy: the descendant might be the honest amendment, the ancestor a discarded draft. Structure gives you the order; the meaning still belongs to the people and, sometimes, their lawyers.

FAQ

How common are incremental saves versus full rewrites?

Common enough to make checking always worthwhile: signature workflows, form fills, and many editors append by design. Whether a particular pair of files carries lineage is exactly what a comparison determines in seconds.

Can descent be faked?

Constructing a fake ancestor inside a file would require building the forgery before the original existed; the containment direction makes after-the-fact fakery effectively self-defeating. The practical attack is erasure, rewriting to destroy lineage, which leaves its own fingerprints.

Does descent show what changed?

Descent itself only proves derivation and order. A comparison adds the deltas: page content changes, metadata shifts, and signature events between the generations.