On this page
Inventory the PDF object graph before editing
Record a neutral file ID, digest, PDF version, xref or object inventory method, page count, catalog reference, names dictionaries, annotations, streams, metadata objects, and incremental update markers if the parser exposes them. A visible page is one rendering surface, not a complete object inventory. Preserve the original file and the tool version used for the inventory.
The PDF Reference source record carries the verified sixth-edition date October 2006. The cited redaction guidance without a verified publication date uses 22 October 2026 as retrieval evidence, not as a publication claim. The source ledger records these distinctions.
| Object evidence | Record | Stop if |
|---|---|---|
| Catalog | Object ID and names entries | Catalog is repaired without a raw copy |
| Name tree | EmbeddedFiles nodes and leaves | Only viewer-visible attachments are listed |
| File specification | Name, EF references, AF relation, external target | Filename is treated as unique identity |
| Stream | Object ID, filters, length, digest | Decoded bytes replace stream evidence |
| Annotation | Subtype, action, file reference | Attachment annotations are skipped |
| Revision | Incremental sections and xref state | Earlier bytes are assumed unreachable |
Use a synthetic PDF object ledger for public review. Do not paste real filenames, document text, embedded bytes, or private metadata. An unreferenced object may still matter to a forensic or redaction workflow, so record how reachability was determined.
Trace every file specification to its embedded or external target
The Adobe Systems Incorporated, (opens in a new tab) describes direct embedded file streams through a file specification EF entry and document-level association through the EmbeddedFiles name tree. Follow both directions: name tree to file specification to EF stream, and file specification or annotation to any stream or external target. Do not deduplicate by filename alone.
| Trace field | Supports | Open question |
|---|---|---|
| Name tree key | A name-to-file-spec mapping | Are duplicate keys normalized? |
| File name | Display or path string | Does another file specification reuse it? |
| EF entry | Embedded stream reference | Is F, UF, or another entry used? |
| AF relationship | Declared associated-file role | Does the role match the object? |
| External reference | File specification target outside the PDF | Is it available or allowed to follow? |
| Attachment annotation | Page-level file association | Is it also in the document name tree? |
Synthetic embedded-file ledger
{"catalog":"obj-fixture-catalog","embedded_files":[{"name":"fixture.txt","file_spec":"obj-fixture-filespec","ef_stream":"obj-fixture-stream","stream_digest":"fixture-digest","af_relationship":"fixture-role"}],"annotations":[{"page":"fixture-page","file_spec":"obj-fixture-filespec"}],"external_targets":[],"decision":"trace-all"}Compare visible redaction with hidden and historical content
The redaction guidance says hidden information can include metadata, comments, attachments, scripts, layers, embedded content, and content from previous saves. Turn that broad list into a bounded checklist: visible page text and images, annotations and actions, metadata, name trees, embedded streams, associated files, forms, layers, and incremental revisions. Record what the chosen tool inspected and what it cannot inspect.
| Review surface | Record | Hold when |
|---|---|---|
| Visible page | Rendered before and after | Overlay only obscures underlying text |
| Content stream | Object references and changed operators | Old text remains in a stream |
| Annotations | Removed, retained, or rewritten | Action points to a hidden file |
| Metadata | Document and XMP state | One metadata packet is assumed to be all |
| Embedded content | Name tree and stream inventory after edit | Attachment remains reachable |
| Previous revisions | Incremental sections and xref state | Older bytes remain in the file |
Write a bounded post-redaction verification report
Compare original and output digests, page count, visible rendering, object references, embedded-file inventory, metadata inventory, annotation inventory, and file size. A smaller file is not evidence that every hidden object was removed. A viewer that shows no attachment is not evidence that no file specification or stream exists.
| Result | Record | Do not claim |
|---|---|---|
| Removed object | Object ID and verification method | All copies of the content are gone |
| Remaining attachment | Name, relation, stream digest, location | Visible pages are safe to share |
| Unreachable stream | Reachability algorithm and scope | Unreachable means deleted |
| Incremental bytes | Revision offsets and tool behavior | Previous saves were overwritten |
| Rendering check | Viewer, version, and screenshots | Rendered view proves object removal |
| Tool limitation | Unsupported features and next action | A pass is a legal clearance |
Stop before calling a PDF redacted
Stop conditions
- Stop if the catalog, name trees, file specifications, streams, annotations, or revisions were not inventoried.
- Stop if a filename is treated as a unique attachment identity.
- Stop if a viewer overlay is the only evidence that page content was removed.
- Stop if metadata, scripts, layers, forms, embedded files, or previous revisions are outside the tool scope.
- Stop if output and source digests, object counts, and tool limitations are not recorded.
- Stop before opening an embedded file when it is untrusted or contains private content.
Pair this worksheet with the data provenance log for source and transformation history and the data card template for collection context. A PDF object report does not prove legal redaction, privacy clearance, ownership, or permission.
For a supported non-health collection, after the owner has authority to describe the scope and a controlled metadata packet, the qualified document-data appraisal request path may be a preparation step. It does not redact PDFs, certify deletion, inspect malware, create a quote, match a buyer, or grant a license.