PDF Forensics Verification for Court Exhibit

need a qualified PDF / digital-document forensics expert to independently review a court-admitted PDF exhibit and validate specific technical findings. The file is a purported Outlook email printed or converted to PDF with an attachment. The PDF was downloaded from NYSCEF and was admitted by opposing counsel as a court exhibit. I have already performed preliminary review, including Adobe Acrobat Preflight review, metadata review, selectability testing, object-behavior review, and visual comparison. I need an expert who can independently reproduce, confirm, qualify, or refute the findings in a professional written report. The purpose is to determine whether the PDF contains objective indicators of reconstruction, alteration, masking, image modification, non-native generation, appended content, or other post-creation manipulation. I am not asking for speculation or a predetermined conclusion. I need a technically grounded analysis of what the file objectively shows. The review should focus mainly on two areas. First, the Outlook-style heading/header block on page 1, including the apparent From, Sent, To, Subject, and Attachments fields. The email body is not the main forensic target. The issue is whether the header block is genuine Outlook-rendered metadata or whether it appears typed, reconstructed, overlaid, screenshotted, OCR-generated, vectorized, flattened, image-based, or otherwise non-native. Second, the entire fourth page, which is represented as the attachment / Kantata burn report. This page is the evidentiary payload of the exhibit. The issue is whether page 4 is technically connected to the attachment listed in the email header, or whether it is merely an appended, reconstructed, altered, or inserted page inside the PDF. Important limitation: the August 28, 2024 modification metadata should not be treated as suspicious standing alone. The PDF was admitted as a court exhibit on August 28, 2024, and the iText modification appears attributable to NYSCEF / court exhibit-admission processing, including superimposition of the exhibit header, exhibit designation, and “ADMITTED 08/28/2024” markings. I do not need an opinion suggesting that the August 28, 2024 iText modification itself is evidence of fabrication. Please disregard the August 28, 2024 iText event unless object-level analysis shows it modified more than the court exhibit overlay. Known issues requiring expert validation: The PDF metadata identifies the file as an Outlook-related mail document, but the creator is “Power PDF Create,” not Outlook or Microsoft Print to PDF. Please determine whether the creation chain is consistent with a genuine Outlook print/export workflow, or whether it is more consistent with a reconstructed litigation exhibit generated through a PDF editor or converter. The visible page 1 attachment line appears to state “1 attachments (1 MB)” and appears to identify the attachment as “2023 Retainer. ******** Manpower.docx.” That is a Word document filename, not a native Kantata export, spreadsheet, CSV, XLSX, PDF, or ordinary report-export format. Yet the exhibit is being used as though page 4 is a Kantata burn report. Please determine whether the attachment line is genuine Outlook-rendered metadata or whether it may have been typed, reconstructed, overlaid, OCR-generated, image-based, or otherwise inserted into the PDF. Please determine whether the PDF contains any actual embedded attachment, file-attachment annotation, /EmbeddedFiles name tree, /Filespec object, or other object-level evidence that the alleged 1 MB .docx attachment is actually present in the PDF. If no embedded attachment exists, please state whether the PDF merely visually depicts an attachment line and does not itself contain or authenticate the underlying attachment. Please determine whether page 4 is structurally connected to the listed “2023 Retainer. *********** [login to view URL]” attachment, or whether page 4 is merely appended to the PDF. Specifically, determine whether page 4 appears to originate from Kantata, Word, Excel, screenshot, OCR, raster image, vectorized spreadsheet content, or another source. Please analyze the size issue carefully. The page 1 header appears to list the attachment as “1 MB,” while the admitted four-page PDF itself is approximately 1.23 MB. I understand Outlook may round attachment sizes and that a printed PDF may not contain the underlying attachment payload. The issue is whether the PDF’s object structure supports the claim that page 4 is the printed contents of the listed 1 MB .docx attachment, as opposed to a later-appended or reconstructed page. Please perform a selectability / text-layer test. When using “Select All” on the admitted PDF, the email body appears selectable, but the Outlook-style heading/header block on page 1 does not appear to be selected. The fourth page, represented as the Kantata burn-report attachment, also does not appear to be selected. Please independently reproduce or refute this behavior. Please test whether the following areas are selectable, searchable, and extractable as live text: the page 1 email header; the page 1 email body; page 4; the name “Courtney *******” on page 4; and the numerical field involving 2319 hours on page 4. A specific control point on page 4 is the name “Courtney H******.” I am not asking the expert to treat the entire row as clearly legible. The relevant point is narrower: the name “Courtney *******” itself appears more visible than surrounding names or text. Based on preliminary review, page 4 appears to contain different gray values, including Gray 1.0, Gray 0.5, and Gray 0.0. Please determine whether the object corresponding to “Courtney *******” is rendered at a different gray value, opacity, layer, object type, font, encoding, mask, or compression treatment than surrounding names or table content. There is also a suspected mathematical / spreadsheet-behavior issue on page 4 involving a 2319-hour figure and what appears to be a formula or calculated spreadsheet field. The issue is that the field appears visually formulaic or spreadsheet-derived, but it does not behave like a live formula or native calculated field. Please determine whether the numerical fields on page 4 are live spreadsheet text, static typed values, rasterized image content, OCR text, vector outlines, or manually reconstructed entries, and whether the 2319-hour figure is internally consistent with the surrounding totals, row values, and apparent spreadsheet structure. Please separate clearly: court/NYSCEF exhibit-stamping artifacts; the underlying PDF creation event; the page 1 email-header content; the page 1 email body; page 4 alleged Kantata burn-report content; the “Courtney *******” gray-value / legibility issue; the 2319-hour / spreadsheet-calculation issue; and any object-level anomalies independent of the court overlay. Requested deliverables: A written forensic report identifying tools used, tests performed, and findings reached; Screenshots or object-level extracts showing the page 1 header behavior and page 4 behavior; A plain-text extraction comparison showing what text is selectable/copyable and what is omitted; A statement as to whether the PDF contains an actual embedded attachment; A statement as to whether page 4 is structurally connected to the listed .docx attachment or appears merely appended; A statement as to whether the page 1 header and page 4 are consistent with native Outlook print/export behavior; A statement addressing the “Courtney ******” gray-value / legibility issue; A statement addressing the 2319-hour / spreadsheet-calculation issue. If the findings support it, I may need the expert to sign an affidavit or declaration summarizing the technical findings. I am not currently seeking in-person testimony. If testimony or appearance were ever required, it would likely be limited to a remote Microsoft Teams / Zoom hearing. Relevant tools may include Adobe Acrobat Preflight, ExifTool, qpdf, PDFiD / pdf-parser, mutool, veraPDF, forensic PDF object-inspection tools, and any other accepted PDF/document-forensics tools. Please identify all tools used and preserve reproducibility. Please provide a CV, a short description of prior PDF/document-forensics experience, and a redacted sample report, affidavit, or declaration if available. Prior litigation-report or expert-witness experience is preferred.

Project ID: 40543543