I had noticed the lack of /ObjStm in the documents on ECF/CM and I have come to the tentative conclusion that the software actually decompresses these artifacts as they are PDF 1.5 onwards.
Additionally we learn that
PDF 1.5 introduced a (optional) new form of XREF; a cross-reference stream rather than a cross-reference table. A PDF 1.5 file may contain one or both for backward compatibility.
If that’s the case then I believe the work flow fully explains the artifacts found by Hermitian in document 35.1
A document was produced using a Fujitsu ScanSnap #S1500 and imported into a PDF using Adobe Paper Capture. [NBC: Note… See Vicklund comments below] As shown by Vicklund this creates the hidden black rectangles and the lines as well as the OCR. As I had pointed out, the document however contains compressed Object Streams, not found in the 35.1 document. But I looked at all the Florida files and none contained /ObjStm objects, even though they were created with Adobe Paper Capture. I will extend the analysis to the Mississippi files now that I have updated my scripts to allow for batch processing.
The resulting document was uploaded to ECF/CM where at least the following steps were applied to the PDF
- A label was added to every page indicating the document number and the page number
- The document was made compatible with PDF 1.3 by uncompressing XREF and ObjStm streams into their separate objects
Without the low level tools, it would not be easy or not possible at all to make these observations and thus come to these conclusions. Once again, the low level tools, used for this kind of forensic investigation show the power of looking at the ‘raw data’.