4 ms·
These PDFs apparently used the “incremental update” feature of PDF, where edits to the document are merely appended to the original file. It’s easy to extract
by layer8 10mo ago
These PDFs apparently used the “incremental update” feature of PDF, where edits to the document are merely appended to the original file.
It’s easy to extract the earlier versions, for example with a plain text editor. Just search for lines starting with “%%EOF”, and truncate the file after that line. Voila, the resulting file is the respective earlier PDF version.
(One exception is the first %%EOF in a so-called linearized PDF, which marks a pseudo-revision that is only there for technical reasons and isn’t a valid PDF file by itself.)
- ajross 10mo agoIt's hilarious the extent to which Adobe Systems's ridiculously futile attempt to chase MS Word features ended up being the single most productive espionage tool of the last quarter century.
- layer8 10mo agoI don’t think this was particularly modeled on MS Word. The incremental update feature was introduced with PDF 1.2 in 1996. It allows to quickly save changes without having to rewrite the whole file, for example when annotating a PDF. Incremental updates are also essential for PDF signatures, since when you add a subsequent signature to a PDF, you couldn’t rewrite the file without breaking previous signatures. Hence signatures are appended as incremental updates.
- cubefox 10mo agoI'm pretty sure you can change various file formats without rewriting the entire file and without using "incremental updates".
- deleted 10mo ago[deleted]
- mattzito 10mo agoNo, if you are going to change the structure of a structured document that has been saved to disk, your options are: 1) Rewrite the file to disk 2) Append the new data/metadata to the end of the existing file I suppose you could pre-pad documents with empty blocks and then go modify those in situ by binary editing the file, but that sounds like a nightmare.
- cubefox 10mo agoAren't there file systems that support data structures which allow editing just part of the data, like linked lists?
- layer8 10mo agoLook at the C file API which most software is based on, it simply doesn’t allow it. Writing at a given file position just overwrites existing content. There is no way to insert or remove bytes in the middle. Apart from that, file systems manage storage in larger fixed-size blocks (commonly 4 KB). One block typically links to the next block (if any) of the same file, but that’s about the extent of it.
- anthk 10mo agoDD should.
- formerly_proven 10mo agoNo. Well yes. On mainframes. This is why “table of contents at the end” is such an exceedingly common design choice.
- PhilipRoman 10mo agoYeah there are, Linux supports parameters FALLOC_FL_INSERT_RANGE and FALLOC_FL_COLLAPSE_RANGE for fallocate(2). Like most fancy filesystem features, they are not used by the vast majority of software because it has to run on any filesystem so you'd always need to maintain two implementations (and extensive test cases).
- layer8 10mo agoYou can’t insert data into the middle of a file (or remove portions from the middle of a file) without either rewriting it completely, or at least rewriting everything after the insertion point; the latter requires holding everything after the insertion point in memory (or writing it out to another file first, then reading it in and writing it out again). PDF is designed to not require holding the complete file in memory. (PDF viewers can display PDFs larger than available memory, as long as the currently displayed page and associated metadata fits in memory. Similar for editing.)
- maweki 10mo agoWhile tedious, you can do the rewrite block-wise from the insertion point and only store a an additional block's worth of the rest (or twice as much as you inserted) ABCDE, to insert 1 after C: store D, overwrite D with 1, store E, overwrite E with D, write E.
- deleted 10mo ago[deleted]
- bahmboo 10mo agoThis was 1996. A typical computer had tens of megabytes of memory with throughput a fraction of what we have today. Appending an element instead of reading, parsing, inserting and validating the entire document is a better solution in so many ways. That people doing redactions don't understand the technology is a separate problem. The context matters.
- ajross 10mo agoPDF files are for storing fixed (!!) output of printed/printable material. That's where the format's roots are via Postscript, it's where the format found its main success in document storage, and it's the metaphor everyone has in mind when using the format. PDFs don't change. PDFs are what they look like. Except they aren't, because Adobe wanted to be able to (ahem) "annotate" them, or "save changes" to them. And Adobe wanted this because they wanted to sell Acrobat to people who would otherwise be using MS Word for these purposes. And in so doing, Adobe broke the fundamental design paradigm of the format. And that has had (and continues to have, to hilarious effect) continuing security impact for the data that gets stored in this terrible format.
- detourdog 10mo agoWhen Acrobat came out cross platform was not common. Being able to publish a document that could be opened on multiple platforms was a big advantage. I was using it to distribute technical specifications in the mid 90's. Different pages of these specifications came from, Filemaker, Excel, Word, Mini-Cad, Photoshop, Illustrator, and probably other applications as well. We would combine these into a single PDF file. This simplified version control. This also meant that bidders could not edit the specifications. None of that could be accomplished with Word alone. I think you are underestimating the qualities of PDF for distribution of complex documents.
- ajross 10mo ago> This also meant that bidders could not edit the specifications. But they can! That's the bug, PDF is a mutable file format owing to Adobe's muckery. And you made the same mistake that every government redactor and censor (up to and including the ?!@$! NSA per the linked article) has in the intervening decades. The file format you thought you were using was a great fit for your problem, and better than MS Word. The software Adobe shipped was, in fact, something else.
- detourdog 10mo agoOur use wasn't that high stakes. I also can't remember all the details but were using 3rd party publishing tools beyond Acrobat. Acrobat was the reader that our specifications could be opened in. We had to use additional software and to add consistent headers and get accurate pager numbers.
- theturtletalks 10mo agoNew OSINT skill unlocked
- toomuchtodo 10mo agoI see an interesting parallel to how people think about captured encrypted data, and how long that encryption needs to be effective for until technology catches up and can decrypt (by which point, hopefully the decrypted data is worthless). If all of these documents are stored in durable archives, future methodologies may arrive to extract value or intelligence not originally available at the time of capture and disclosure.
- theturtletalks 10mo ago> If all of these documents are stored in durable archives, future methodologies may arrive to extract value or intelligence not originally available at the time of capture and disclosure. I recently learned that some people improve or brush up on their OSINT skills by trying to find missing people!
- TazeTSchnitzel 10mo agoMicrosoft Word once had a "Fast Save" feature which did this. It's hard to find much information about it these days. Supposedly it was removed in Office 2003 SP3: https://www.betaarchive.com/wiki/index.php?title=Microsoft_KB_Archive/938808 https://www.betaarchive.com/wiki/index.php?title=Microsoft_K....