The WH LFBC PDF contains an easily detectable JPEG comment in one of its Objects. The comment, found after Hex Marker 0xFF 0xFE states ‘YCbCr’ and in case of the White House tax form, which is in gray scale, ‘lineargray’. This is a ‘useless’ comment added by the software for one reason or another. The same comment has been found in other Xerox WorkCentre created documents on both a 7535 and a 7655 WorkCentre.
I cannot find the comment in the raw Xerox file.
The Xerox only workflow adds a /FlateDecode step after it created the JPEG /DCTDecode stream, which is like zipping up a file and then trying to find content in the zip file without unzipping it. There are several simple ways to extract the stream, run it through a deflate step which creates the jpeg and opening the JPEG up in a Hex Editor for further scrutiny
The comment was forged
So far this seems to be based on a confusion with tool sets and offsets. Since I have provided the raw and preview saved documents, anyone can repeat my steps and observe. Since others have indeed been able to repeat my process, I have to reject this as user error.
The screenshot does not match with the text
Hermitian did not understand that there are different text encodings used and that when properly matching the Hex values shown, the strings did match.