document-forensics

Detect visual redactions by converting PDF pages to images and using OpenCV to find large dark rectangular regions with width-to-height ratios above 2. White-box redactions are harder; look for unusual whitespace gaps and compare character spacing against the document average.

Extract PDF metadata using pdfplumber in Python or the exiftool command-line utility. Key fields include author, creator tool, creation and modification dates, producer, and PDF version, which together reveal authenticity and suspicious indicators.

Suspicious indicators include creation dates after the date stated in the text, creator tools inconsistent with the document type, stripped metadata in a batch where others retain it, and modification dates clustered near disclosure deadlines. Flag these as anomalies rather than conclusions, since innocent explanations may exist.

No, automated forensic analysis produces findings, not conclusions. The workflow automates inventory, provenance, timeline, anomaly, redaction, and validation steps, but the final narrative synthesis explicitly requires human judgment and must be clearly separated from automated findings.

Avoid forensic analysis for known-clean internal documents with no investigative purpose, since the overhead is unnecessary for trusted content. Also use dedicated NER or entity-resolution tools for text-level entity extraction, as forensics operates at the provenance and structure level.