The Redaction That Was a Layer: PDF Incremental Updates
The challenge
A settlement PDF was released with the other party's name blacked out, and the court copy shows REDACTED where the name used to be. A PDF is not a flat picture though: it keeps its edits as layers, and blacking something out in the wrong tool adds a new layer over the old one instead of removing it. The raw bytes of the file are in the viewer. Read them and recover the name that was supposed to be gone.
What you'll learn
- Explain that a PDF stores edits as appended incremental revisions
- Locate revision boundaries by finding %%EOF markers in the bytes
- Recover content a later revision replaced but did not remove
- Recognise visual blackout as a non-redaction that leaves text intact
- State how to redact a document so nothing survives underneath
Skills tested
Prerequisites
- Reading an ASCII column in a hex view
- The idea that files keep history
How it works
A PDF is edited by appending. The original content is written and closed with %%EOF; later changes are added after it as an incremental update with its own %%EOF. A reader shows the most recent definition of each object, so it looks like the latest version is the only version.
It is not. Every earlier revision is still in the file, before the earlier %%EOF. A box drawn over text, or a metadata edit saved this way, adds a new layer and leaves the old bytes untouched. Reading the raw file recovers whatever an earlier revision held.
This is a routine real-world leak: redaction done visually, or document properties changed, without flattening or sanitising, so the original persists in an old revision, an object stream, XMP metadata or a thumbnail.
Common mistakes
- Reading the last revision. That is where
REDACTEDlives; the original is before the first%%EOF. - Trusting the rendered page. The viewer shows the latest layer only; the bytes carry all of them.
- Answering
REDACTED. That is the replacement, not the recovered name. - Expecting encryption. Nothing is encrypted; the name is sitting in plain bytes.
How to defend against it
Redact by removing, then flatten.
- Use a true redaction tool that deletes the underlying text and images, not one that draws an opaque box over them.
- Flatten or re-export the document afterwards (for example print to a new PDF) so no incremental history remains.
- Strip metadata (XMP, document info, embedded thumbnails) before release.
- Treat every published document as carrying its full edit history until it has been sanitised.