Adobe PDF文件中残留信息的取证分析
Forensic Analysis of Residual Information in Adobe PDF Files
摘要：
近年来，由于电子文件包括个人记录和商业活动，这些文件可以作为数字取证调查过程中的重要证据。一般来说，可以使用自己的应用程序进行验证的数据主要用于调查文档文件。然而，在目前已被大量使用的PDF文件的情况下，包括某些修改之前的数据的某些数据无意中存在于电子文档文件中。因为这样的残留信息可以呈现文件的写入过程，所以它可以有用地用于取证的观点。本文介绍了PDF文件中残留信息存在的原因，并给出了一种提取残留信息的方法。此外，我们还演示了PDF文件的属性可以用来隐藏数据。
英文摘要：
In recent years, as electronic files include personal records and business activities, these files can be used as important evidences in a digital forensic investigation process. In general, the data that can be verified using its own application programs is largely used in the investigation of document files. However, in the case of the PDF file that has been largely used at the present time, certain data, which include the data before some modifications, exist in electronic document files unintentionally. Because such residual information may present the writing process of a file, it can be usefully used in a forensic viewpoint. This paper introduces why the residual information is stored inside the PDF file and explains a way to extract the information. In addition, we demonstrate the attributes of PDF files can be used to hide data.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
