Document Forensics - Free Online PDF, Word, Excel & PowerPoint Analyzer
Document Forensics
Drop a PDF or an Office document. A PDF gets its edit history reconstructed save by save; a Word, Excel or PowerPoint file gets its metadata, tracked changes, hidden content, external links and macro source read in full - without uploading anything.
Drop a PDF or Office document here
.pdf .docx .xlsx .pptx .docm .xlsm .pptm .doc .xls .ppt .rtf - or click to browse from your device
Choose documentSupported documents
- PDF - revision history, what changed between saves, redaction check, embedded JavaScript, signature coverage, fonts, images and attachments.
- Word, Excel, PowerPoint - metadata, tracked changes and comments, hidden text, sheets and slides, external links, embedded objects, VBA and XLM macro source. Includes .docm/.xlsm/.pptm and legacy .doc/.xls/.ppt.
- RTF - group structure and every embedded OLE object.
The file's own bytes decide which analysis runs; the extension is only a fallback. Load a document to see its analysis tools here.
Document Overview
What the file's own structure declares, before any page is rendered.
Revision History
Every incremental save left in this file, oldest first. Select one to see which objects it wrote.
What Changed Between Saves
Page content is re-read as of each revision and compared, so you see the text a later save added or removed.
--
Redaction Check
Text that is still in the content stream underneath something painted over it. A dark box drawn on top hides text from a reader, not from the file - and this is reported as a lead to check, never as a verdict, because table shading and figure overlays look identical.
--
Metadata
The document information dictionary and any embedded XMP packet, shown exactly as stored.
Embedded JavaScript
Scripts stored inside the document, plus the triggers that would run them. Shown as plain text and never executed.
--
Digital Signatures
Which signature fields exist and how much of the file each one covers.
--
Fonts, Images & Attachments
What the document carries inside it, which pages use each font, which save introduced it, and which embedded images can be pulled back out.
Object Graph
Every indirect object in the file, with the revision that first wrote it and the one that last changed it.
--
| # | Type | Subtype | Kind | Stream | Rev. | Keys |
|---|
Strings
Printable text found anywhere in the raw file, including inside revisions that a reader would never display.
--
Document Overview
What this document is, who is recorded in it, and what stands out about the way it was built.
Metadata
The properties Office writes into every document - author, organisation, total editing time, revision count - shown parsed and as raw XML. Pre-2007 files show their OLE property sets instead.
Revisions & Hidden Content
Tracked changes, comments, hidden text, hidden worksheets and slides, and the revision-save identifiers Word keeps from every editing session. None of this is visible in a normal read of the document.
Macros (VBA & XLM)
The complete source of every VBA module, decompressed from the project. Nothing is executed, emulated or resolved - the code is shown as text, and constructs worth a closer read are flagged beside it. Excel 4.0 macro sheets, which run from cells with no VBA project in the file at all, are listed separately below.
Links & External References
Every relationship the document declares, with anything pointing outside the file flagged. Remote targets are shown as plain text and are never contacted - this page makes no network request of any kind.
Embedded Objects & Media
Images and embedded files stored inside the document, with the type each one claims by its name checked against what its own first bytes actually are. Any image can be saved to your device and examined in Image Forensics, where its own EXIF is read. For an RTF file this tab shows the group structure and every embedded OLE object instead.
Container Integrity & Signatures
A modern Office file is a ZIP archive. Its index is cross-checked against each part's own header, and every part that is read is verified against its recorded checksum. Any digital signature stored in the package is listed with the parts it does - and does not - cover.
Document Parts
Every file inside the container. Select one to read it as text.
Text Across All Parts
Readable text pulled from every part of the document, including headers, footers and parts that are never displayed.
--
Understanding Document Forensics
Why a PDF Remembers Its Own Edits
When a PDF is edited and saved incrementally, the editor does not rewrite the file. It appends the objects that changed, a new cross-reference table describing where they went, and a new trailer that points back at the previous one. The original bytes are still there, untouched, underneath. Walking that chain of trailers backwards reconstructs the document as it stood at every save - which is closer to reading a version-control log than to any statistical guess about whether a file was altered. To show what a save altered, each page's content stream is read as of the earlier and the later revision and the two are compared, line by line.
A .docx Is a ZIP File Full of XML
Since 2007, Word, Excel and PowerPoint files have been ordinary ZIP archives containing a tree of XML parts. That is why so much survives inside them that a reader never sees: the document body, the metadata, the tracked changes, the comments, the relationships to other files and any embedded macro project are all separate parts sitting side by side in the archive. Deleting text from a page does not necessarily remove it from the parts, and turning off "show markup" changes nothing about what is stored - it only changes what is drawn on screen.
The Redaction That Wasn't
The most common way sensitive information escapes a document is not a clever attack. In a PDF it is a dark box drawn over text that is still in the content stream underneath; in an Office file it is a document sent out with track changes still recorded, comments still attached, or text merely marked hidden rather than deleted - every one of them stored in full, with the author's name and a timestamp, and every one invisible in a normal read. Excel adds its own version: a worksheet can be marked "very hidden", a state that cannot be undone from the Excel interface at all.
Scripts and Macros Are Read, Never Run
A PDF can carry JavaScript with triggers that would run it on open; an Office document can carry a VBA project, stored as a compound file compressed with a scheme of Microsoft's own. This tool extracts both as plain text - walking the VBA container to find where each module stops being compiled bytecode and starts being compressed source, and decompressing it in full, even in projects marked "locked for viewing". Knowing a macro exists tells you very little; reading what it does tells you everything. Nothing is executed, emulated or resolved, and no external target a document points at is ever contacted.
Indicators, Not Proof
Everything on this page describes what is stored in the file, which is not the same as what happened or what was intended. Multiple PDF revisions are completely normal: adding a comment, filling a form field, signing, or simply saving again all produce one. Plenty of ordinary business macros call Shell or CreateObject; plenty of legitimate documents carry tracked changes because a review is still in progress; a hidden worksheet is very often just a lookup table someone tidied away. Equally, an empty result is not a clean bill of health - saving through almost any converter flattens a PDF's history away entirely, and this tool reads structure and text without evaluating what a macro would actually do when run. Treat every finding as a lead to corroborate against the original source and the people involved, and where the stakes are high, involve someone qualified rather than relying on a single automated read.
Key Takeaways
- One drop zone, the right analysis: the file's own bytes decide whether it is read as a PDF or an Office document, so a renamed file cannot slip past.
- PDF edit history is reconstructed, not guessed: every incremental save left in the file is listed with its byte range, its producer and the objects it wrote.
- Hidden is not deleted: tracked changes, comments, hidden text, hidden slides and very-hidden worksheets are read straight out of an Office file, and text under a PDF redaction box is reported as a lead.
- Scripts and macros are shown, never run: embedded JavaScript and every VBA module are extracted as plain text, and external targets are listed, never followed.
- Nothing leaves your device: every parse, decompression and comparison runs client-side in your browser.