Portable document format (PDF) image embedding and analysis: Foundational structures for forensic examination

This technical note addresses forensic challenges in analyzing how images are embedded and represented within Portable Document Format (PDF) files. It was developed to support forensic practitioners-particularly those engaged in digital image analysis-in interpreting embedded image structures through hex-level inspection and format-specification-aligned analysis. Exploratory testing was conducted using hex editors and JSON-generated structure reports to examine internal PDF components, object models, and syntax in accordance with International Organization for Standardization (ISO) PDF standards. Embedding behaviors were analyzed across common image formats and insertion methods using Adobe Acrobat and LibreOffice Draw. The study identified a modular taxonomy of embedded image types and software-specific behaviors, revealing consistent internal structures with subtle variations in object placement and metadata retention. GIF-derived embeddings exhibited palette-based encoding and transparency features requiring specialized verification. This technical note introduces foundational methods for object-level interpretation of embedded image structures in PDFs, supporting examiner-led validation and reproducible structural comparison. Future work will extend these observations through broader sampling and quantitative assessment. The work aligns with priorities identified by the Video/Image Technology and Analysis (VITAL) subcommittee of the Organization of Scientific Area Committees for Forensic Science (OSAC), which called for improved understanding of PDF image lifecycle integrity.