When hundreds of financial documents land at the centre of a legal dispute, one question outranks all the others: have they been changed?

The scenario

A folder of financial records, over 300 PDF documents, had been shared and downloaded from a cloud storage platform roughly two years before it became relevant to a legal matter. The documents covered years of bank statements and tax filings. The question in front of us was whether anything had been modified, deleted or added to that folder since the day it came down.

Nobody had access to the original cloud storage environment for comparison. All we had was a forensic image of the computer that received the download. As it turned out, that was enough.

Why this comes up more than you'd think

In civil litigation, regulatory proceedings and financial disputes, digital documents get produced as evidence routinely. Lawyers, opposing parties and courts all end up asking the same thing: are these authentic originals, or have they been altered after the fact?

A PDF looks the same whether it is genuine or manipulated. You cannot tell by looking at it. What you need is forensic analysis of the file itself, the operating system artifacts surrounding it, and the metadata embedded within it. When multiple independent sources all tell the same story, that story becomes very hard to dispute.

"A PDF looks the same whether it's genuine or manipulated. You can't tell by looking at it."

How we approached it

The examination started with a forensic image of the subject computer, meaning a complete sector-by-sector copy of the hard drive capturing everything including deleted files, filesystem metadata and system artifacts. From that image, Magnet AXIOM extracted the relevant artifacts, and we worked through the evidence layer by layer.

Layer 1: Cryptographic hash verification

An MD5 hash is a mathematical fingerprint of a file's complete binary content. Change a single character and the hash changes entirely. Two files sharing a hash are, for all practical purposes, identical.

A reference forensic report had been independently prepared by another examiner on this matter, and it included MD5 hash values for a subset of the documents. We computed MD5 hashes for all 325 files on the imaged drive and compared them against those reference values.

Every hash matched exactly. Not one mismatch across the 71 files for which we had reference values.

Hash verification is the gold standard for document integrity. If the hashes match, the files are identical. There is no room for opinion or interpretation in it.

Layer 2: PDF internal metadata

Every PDF contains an internal metadata stream recording, among other things, the software that created it, the device it was produced on, and the dates it was created and last modified. That information is embedded inside the file, separate from filesystem timestamps and independent of the operating system.

We extracted internal metadata from all 324 PDF documents. The bank statements consistently identified their creator as the authorized vendor responsible for generating those statements on behalf of the financial institution. The tax filings consistently identified specific Xerox scanning devices. Every modification date recorded inside the PDFs predated the download date.

Had someone edited one of these PDFs, even with a tool trying to hide the changes, the Creator and Producer fields would typically shift to reflect the editing software. We saw nothing of the kind. Every file's internal metadata was consistent with an authentic, unaltered original.

Layer 3: Filesystem timestamps

The NTFS filesystem records when each file was created, modified and last accessed. Those timestamps live in the Master File Table and are distinct from anything inside the file itself.

All 325 files carried filesystem Created and Modified timestamps within a two-minute window on the same day, which is the date the files were downloaded. A two-minute spread across 325 files is the signature of a ZIP archive extraction, where files are written to disk sequentially and produce a tight cluster of timestamps.

No file had a Modified timestamp after the download date. If any file had been edited and re-saved, its Modified timestamp would have updated. None had.

Layer 4: Windows Shell Link (LNK) files

Every time you open a file in Windows, the operating system creates a hidden shortcut file called a Shell Link, or .lnk. These are stored separately from the target file and record the target's metadata, size and timestamps included, at the moment you opened it. They persist even if the target is later changed or deleted.

We analyzed 1,576 LNK files recovered from the forensic image. Among them were shortcuts pointing to the source ZIP archive containing the documents. Those records showed the archive was first opened on the same day it was downloaded, and had been accessed several more times in the months since. The target Modified timestamp recorded by each LNK file, capturing the state of the ZIP at each access, was identical every single time: the original download date. The ZIP had never changed.

LNK files are particularly valuable because the operating system creates them automatically, with no user involvement, and stores them somewhere other than the files they reference. They are difficult to fabricate convincingly, and the data in each one is a snapshot of the target's state at that moment.

Layer 5: Registry and deletion artifacts

We also examined Windows ShellBag registry entries, which record folder navigation history, along with the Windows Recycle Bin artifacts. The Recycle Bin was entirely empty, so no case documents had been deleted into it. The ShellBag records showed normal user access to the document folders, consistent with someone reviewing files rather than manipulating them.

What we found

Six independent evidence sources, all telling the same story:

Every layer said the same thing: the documents had been downloaded once, on a specific date, and had not been touched since. The finding corroborated the independently prepared reference report, which had reached the same conclusion by a different route.

"The finding was consistent across six independent evidence sources. When that many independent lines of evidence agree, the conclusion becomes very hard to challenge."

Why multiple layers matter

Any single piece of evidence can be challenged in principle. Timestamps can be manipulated. Metadata can be edited. Individual artifacts can be questioned. But when six independent sources, each recorded by a different mechanism, stored in a different location and examined with a different tool, all arrive at the same conclusion, the story becomes extremely difficult to dispute.

That is the core principle behind layered forensic analysis. Not just finding one answer, but finding the same answer along multiple independent paths. The more the evidence converges, the stronger the conclusion.

In this case the convergence was complete. Cryptographic mathematics, PDF internal metadata, filesystem records, operating system artifacts and registry data all agreed. The documents were authentic and unaltered.

What this means for you

Whether you are in litigation, responding to a regulatory inquiry, running an internal investigation, or simply trying to verify the integrity of records you have received, digital forensics can answer the question with evidence rather than guesswork.

The methods described here work on any Windows computer, for any document type, and produce findings that can be presented in legal proceedings. If the question is whether these files were changed, forensic analysis is how you get a defensible answer.

Need to verify document integrity? Data Rescue Labs conducts forensic examinations for legal matters, internal investigations, and corporate due diligence. Our findings are documented in formal reports suitable for court or regulatory use. Contact us to discuss your case.