ByteRange
Definition
A four-integer entry in a PDF digital signature dictionary specifying which byte ranges of the file were hashed when the signature was created. Content outside the ByteRange is not covered by the signature.
- Location
- PDF digital signature dictionary
- Format
- Four integers marking hashed byte spans
- Purpose
- Defines exactly what content the signature covers
- Forensic relevance
- Content outside ByteRange can be altered post-signing undetected
Common questions
Why does the ByteRange matter to a document forensics examiner?+
A PDF can contain content, such as an added annotation or a later revision, that sits outside the byte spans the signature actually hashed. That content will not invalidate the signature even though it was added after signing, so checking the ByteRange against the file's full length exposes this kind of incremental-update tampering.
Does a valid signature always mean the entire visible document is authentic?+
No. A valid signature only guarantees that the bytes named in the ByteRange are unchanged since signing. Examiners compare the ByteRange coverage to the total file size and inspect any incremental updates appended afterward to confirm nothing material was added outside the signed range.
Related terms
- Content-Aware Fill
- An image editing feature (Photoshop from CS5; AI-driven from version 22.0) that replaces a masked region with synthesised pixel content matching the...
- Copy-Move Detection
- A class of image forensics algorithms that search for duplicated regions within a single image, indicating a patch-and-conceal manipulation. Implemented via block...
- Cross-Reference Table (Xref)
- The index structure at the end of a PDF file that maps each object number to its byte offset. Multiple xref sections...
- Error Level Analysis (ELA)
- A technique that re-compresses a JPEG at a controlled quality setting and maps the pixel-level difference between the re-compressed and original images....
- EXIF (Exchangeable Image File Format)
- A metadata standard embedded in JPEG and TIFF files by capture devices. EXIF fields record camera make and model, lens data, exposure...
- Incremental Update
- The PDF mechanism by which an editing application appends new or modified objects to the end of an existing file without overwriting...
- JPEG Ghost Analysis
- A technique (Farid, 2009) that identifies double-compressed patches by resaving a composite JPEG at multiple quality levels and identifying the quality at...
- PRNU Fingerprint
- Photo Response Non-Uniformity: the unique pattern of pixel-level sensitivity variations in a camera sensor, which acts as a device fingerprint. Used to...
- XMP Metadata
- Extensible Metadata Platform (ISO 16684), an XML-based metadata stream embedded in many PDF and image files alongside the information dictionary. Discrepancies between...