Cross-Reference Table (Xref)
Definition
The index structure at the end of a PDF file that maps each object number to its byte offset. Multiple xref sections indicate incremental updates, each corresponding to a post-original edit of the document.
- Location in file
- End of a PDF file
- Function
- Maps object numbers to their byte offsets
- Multiple sections indicate
- Incremental updates after the original save
- Forensic use
- Reconstructing the edit history of a PDF
Common questions
Why does the number of xref sections matter to a document examiner?+
Each additional xref section corresponds to a later incremental save, so counting them gives a minimum number of times the file was reopened and changed after its original creation, which is useful when a party claims a PDF was never edited.
Can the xref table be edited to hide a document's revision history?+
A PDF can be resaved so that only a single, consolidated xref table remains, which erases the incremental trail. That is why examiners also check embedded metadata and object streams rather than relying on the xref table alone.
Related terms
- ByteRange
- A four-integer entry in a PDF digital signature dictionary specifying which byte ranges of the file were hashed when the signature was...
- Content-Aware Fill
- An image editing feature (Photoshop from CS5; AI-driven from version 22.0) that replaces a masked region with synthesised pixel content matching the...
- Copy-Move Detection
- A class of image forensics algorithms that search for duplicated regions within a single image, indicating a patch-and-conceal manipulation. Implemented via block...
- Error Level Analysis (ELA)
- A technique that re-compresses a JPEG at a controlled quality setting and maps the pixel-level difference between the re-compressed and original images....
- EXIF (Exchangeable Image File Format)
- A metadata standard embedded in JPEG and TIFF files by capture devices. EXIF fields record camera make and model, lens data, exposure...
- Incremental Update
- The PDF mechanism by which an editing application appends new or modified objects to the end of an existing file without overwriting...
- JPEG Ghost Analysis
- A technique (Farid, 2009) that identifies double-compressed patches by resaving a composite JPEG at multiple quality levels and identifying the quality at...
- PRNU Fingerprint
- Photo Response Non-Uniformity: the unique pattern of pixel-level sensitivity variations in a camera sensor, which acts as a device fingerprint. Used to...
- XMP Metadata
- Extensible Metadata Platform (ISO 16684), an XML-based metadata stream embedded in many PDF and image files alongside the information dictionary. Discrepancies between...