# Best tool for PDF Forensics **URL:** \ **Category:** Digital Forensics\ **Created:** [September 7, 2022, 8:20pm UTC](https://community.metaspike.com/t/best-tool-for-pdf-forensics/1090 "2022-09-07T20:20:17Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\ **Post date:** [September 7, 2022, 8:47pm UTC](https://community.metaspike.com/t/best-tool-for-pdf-forensics/1090/2 "2022-09-07T20:47:39Z")
I find PDF Stream Dumper by David Zimmer and PDF CanOpener quite useful in PDF analysis. A powerful text editor is also a must—and, 010 Editor has a binary template for the PDF format by Didier Stevens and Christian Mehlmauer which makes it a good option for reviewing PDF structures. [PDF Stream Dumper](http://sandsprite.com/blogs/index.php?uid=7&pid=57) [PDF CanOpener](https://www.windjack.com/product/pdfcanopener/) [010 Editor](https://www.sweetscape.com/) — [PDF Binary Template](https://www.sweetscape.com/010editor/repository/files/PDF.bt) Didier Stevens also has a few Python scripts that target PDF documents here: > **[PDF Tools](https://blog.didierstevens.com/programs/pdf-tools/)** > > Here is a set of free YouTube videos showing how to use my tools: Malicious PDF Analysis Workshop. pdf-parser.py This tool will parse a PDF document to identify the fundamental elements used in the… **2023 Update:** As of version 2.1.11, [Forensic Email Intelligence](https://www.metaspike.com/forensic-email-intelligence/) has powerful PDF analysis capabilities, including the ability to review multiple metadata streams and extract timing information from PDF components, such as annotations. Details and video walkthrough: > [@Forensic Email Intelligence 2.1.11 Release Notes](https://community.metaspike.com/t/forensic-email-intelligence-2-1-11-release-notes/1688): > > Today’s FEI release takes FEI’s holistic view of email and attachments a step further. Let’s take a look at what’s new winkPDF Deep Scan and XMP Metadata Streams When examining PDFs, carefully reviewing the multiple XMP metadata streams they may contain is often close to the top of my to-do list. But that is not all—PDFs also contain key timing information in other areas, such as annotations, embedded attachments, and more. FEI now makes it a breeze to not only see all this information in o… **2024 Update:** This shell script can also be useful for automating some examination tasks on PDFs: > **[GitHub - jjrboucher/PDF-Processing: Script to process PDF files](https://github.com/jjrboucher/PDF-Processing)** > > Script to process PDF files I hope other examiners in the Community have some additional recommendations for you 😁 --- _[View the full topic](https://community.metaspike.com/t/best-tool-for-pdf-forensics/1090)._