document-forensics

Document forensics detects redactions and metadata anomalies by systematically extracting embedded metadata using pdfplumber and exiftool, then applying image analysis to identify visual or subtle white-box redactions across the file collection.

Cross-document validation is an investigative workflow technique that compares text and metadata across a document collection to detect contradictions, corroborate provenance, and uncover hidden fabrications in legal or financial corpora.

Yes, the document forensics workflow leverages exiftool and pdfplumber to perform provenance analysis on financial reports, verifying document origin and authenticity by examining embedded metadata and creation timestamps.

The best way to analyze a leaked document collection is using an 8-step investigative workflow that guides provenance analysis, anomaly detection, redaction identification, and cross-document validation to build a reliable timeline of events.

Yes, you need cv2 and dateutil installed to support the document forensics workflow, as cv2 handles image analysis for visual redaction detection and dateutil processes chronological anomalies in document metadata.

Anomaly detection for document creation times relies heavily on intact metadata; if files have been stripped of exif data or had timestamps deliberately falsified, the validation process may require cross-referencing text content to confirm inconsistencies.