Training  /  Module 8 of 8  /  12 min

Checking your own document

How to tell whether two versions of an agreement are really the same, using tools you already have. A short, practical introduction to document forensics.

What you will take away

  • Every PDF carries internal metadata that most people never look at, and it often contradicts the cover email.
  • A one-minute properties check tells you who created a file, with what software, and when it was last modified.
  • Word's Compare feature produces a reliable redline between two versions in about thirty seconds.
  • Preserve originals. Opening and re-saving a PDF can destroy the very information you need.

Why this module exists

A separation agreement arrives. Then a second version arrives, described as the same document. You are told nothing has changed.

Is it?

You can usually answer that question yourself, in a few minutes, with software you already have. This module shows you how. It is practical and limited on purpose: it will help you notice that something changed, but it will not make you an expert witness.


Rule zero: preserve first

Before you examine anything, make a copy and work from the copy.

Opening a PDF and re-saving it, running it through an online converter, or printing it to a new PDF rewrites its internal metadata. The information most worth having is the information those operations destroy.

Keep originals exactly as received, with their original filenames, in a folder you do not touch.


Check 1: the properties panel, one minute

Every PDF carries a document information block. You do not need special software to see it.

On a Mac: open in Preview, then Tools, then Show Inspector. On Windows: open in Adobe Acrobat Reader, then File, then Properties. In most browsers: open the PDF, then use the document properties item in the viewer menu.

You will see fields like these:

Field What it tells you
Title Often the original Word filename, which can reveal a template name
Author The account that created the source document
Creator The application that produced the original, such as Microsoft Word
Producer The tool that generated the PDF, such as Acrobat PDFMaker or a signing platform
Created When the PDF was generated
Modified When it was last changed. If this differs from Created, the file was altered after creation
PDF version The format version, such as 1.6 or 1.7
Page count The simplest check of all

What to compare between two versions: if an employer says two files are identical, they should not have different authors, different producing applications, different page counts, or a PDF version that went backwards. Identical documents have identical fingerprints.

When an employer says two files are the same and they differ on nearly every one of those fields, the fields are telling you something the cover email is not.


Check 2: the page count and the word count, thirty seconds

The least technical check is often the most decisive.

  • Compare page counts. Two pages is not a formatting difference.
  • Copy the text of each document into a word processor and compare word counts. A difference of several hundred words is not a clean-up.

A replacement that is pages and hundreds of words longer, sent with a cover email saying nothing has changed, is one clear version of this problem.


Check 3: a real redline, thirty seconds

Microsoft Word will compare two documents and produce a marked-up version showing every change.

  1. Convert both PDFs to Word documents, or paste the text of each into a separate Word file.
  2. In Word: Review, then Compare, then Compare Documents.
  3. Choose the original and the revised version.
  4. Word produces a third document with every insertion and deletion marked.

Free alternatives exist, including the comparison features in Google Docs and various online diff tools. If the document is sensitive, prefer a local tool over uploading it to a website.

Note that this changes the files, which is why rule zero matters. Convert copies.


Check 4: the signing certificate

Most e-signature platforms generate a certificate of completion or audit trail as a separate document. It is not the agreement. It is the record of the signing event, and it is frequently more informative than the agreement itself.

A certificate typically shows:

  • The envelope or transaction identifier
  • Each recipient, with the email address used
  • Timestamps for sent, viewed and signed, often to the second
  • The IP address recorded for each action
  • The document hash or checksum

What to look at:

  • Sent to viewed to signed. How long did you actually have the document open before signing? In some signing records, a release of all claims shows as viewed and signed less than a minute apart. Ask yourself when you first had the full text, and whether you had read it, before that minute.
  • The email address used. Was it your work address, which you were about to lose, or a personal one?
  • Multiple identifiers. If the same executed document carries more than one transaction identifier, it passed through more than one signing envelope. That is worth understanding.

Download the certificate whenever you sign anything. It is a separate file and it is easy to miss. Months later it may be the only record of what happened and when.


Check 5: internal inconsistencies, five minutes

You do not need any tools for this one. Read for self-contradiction.

  • Do two sections state different review periods? Two different numbers of days in one document is a sign of editing, not drafting.
  • Does the document body contradict the cover email? A page telling you not to sign before your last day, next to an email saying you can sign right away, cannot both be right.
  • Are there punctuation artifacts, like stray punctuation where a word used to be, or a stray bracket, or a leftover placeholder? Those are the fingerprints of hand editing a template.
  • Are defined terms used consistently? A term defined once and then used differently suggests a section was moved in from elsewhere.

Ambiguity in a contract is generally construed against the party that drafted it. You are not expected to resolve these. You are expected to notice them and ask.


What this does and does not prove

It can show that two files are not the same file, that a document was edited after a stated date, that a signature happened within a specific number of seconds, or that a document contradicts itself.

It cannot show intent, and it cannot tell you whether any of it was improper. Many differences have innocent explanations. A changed producer might mean someone re-exported a file. A late modification timestamp might be a platform operation.

These checks turn a vague feeling that something is off into a specific, documented question you can put in writing. That is as far as a non-specialist should go.

If the stakes are high and the differences are material, that is when to involve a lawyer, and potentially a qualified forensic document examiner.


The two-minute habit

Every time you sign anything electronically, for the rest of your career:

  1. Download the executed PDF.
  2. Download the certificate of completion.
  3. Save both to personal storage, with the date in the filename.

That habit costs two minutes and eliminates most of the problems described across this entire site.

Not legal advice

General information about California law as of November 2026, not advice about your situation. Deadlines and rules change. Seefree and low-cost help in California.