PDF Modification Detection

import hashlib
from datetime import datetime
from typing import Optional

class PDFForensicAnalyzer:
    """Analyze PDF for signs of modification"""
    
    EXPECTED_PRODUCERS = {
        "w2": ["IRS", "ADP", "Paychex", "QuickBooks"],
        "tax_return": ["IRS", "TurboTax", "H&R Block", "TaxAct"],
        "bank_statement": ["Bank", "Statement", "Financial"],
        "pay_stub": ["ADP", "Paychex", "Gusto", "Paylocity"]
    }
    
    def analyze_pdf(self, pdf_path: str, doc_type: str) -> dict:
        """Perform forensic analysis on PDF"""
        
        result = {
            "metadata": {},
            "structure": {},
            "modifications": [],
            "risk_indicators": [],
            "risk_score": 0.0
        }
        
        # Extract metadata
        metadata = self.extract_metadata(pdf_path)
        result["metadata"] = metadata
        
        # Check creation vs modification
        if metadata.get("modified") and metadata.get("created"):
            created = metadata["created"]
            modified = metadata["modified"]
            
            if modified > created:
                time_diff = (modified - created).days
                result["modifications"].append({
                    "type": "date_mismatch",
                    "created": str(created),
                    "modified": str(modified),
                    "days_between": time_diff
                })
                
                if time_diff > 1:
                    result["risk_indicators"].append("modified_after_creation")
                    result["risk_score"] += 0.3
        
        # Check producer
        producer = metadata.get("producer", "")
        expected = self.EXPECTED_PRODUCERS.get(doc_type, [])
        
        if not any(exp.lower() in producer.lower() for exp in expected):
            if "adobe" in producer.lower() or "pdf-" in producer.lower():
                result["risk_indicators"].append("pdf_editor_used")
                result["risk_score"] += 0.35
        
        # Analyze structure
        structure = self.analyze_structure(pdf_path)
        result["structure"] = structure
        
        # Check incremental saves
        if structure.get("incremental_saves", 0) > 1:
            result["risk_indicators"].append("multiple_saves")
            result["risk_score"] += 0.25
        
        # Check fonts
        fonts = structure.get("fonts", [])
        if len(set(fonts)) > 3:  # Too many different fonts
            result["risk_indicators"].append("font_inconsistency")
            result["risk_score"] += 0.2
        
        # Text layer vs image comparison
        text_image_match = self.compare_text_to_image(pdf_path)
        if not text_image_match["matches"]:
            result["risk_indicators"].append("text_image_mismatch")
            result["risk_score"] += 0.4
            result["modifications"].append({
                "type": "text_layer_edited",
                "discrepancies": text_image_match["discrepancies"]
            })
        
        result["risk_score"] = min(result["risk_score"], 1.0)
        
        return result
    
    def extract_metadata(self, pdf_path: str) -> dict:
        """Extract PDF metadata"""
        
        # Using PyPDF2 or similar
        metadata = {
            "created": None,
            "modified": None,
            "producer": "",
            "creator": "",
            "title": "",
            "author": ""
        }
        
        # Parse PDF and extract /Info dictionary
        # ...implementation with PDF library...
        
        return metadata
    
    def analyze_structure(self, pdf_path: str) -> dict:
        """Analyze PDF internal structure"""
        
        structure = {
            "incremental_saves": 0,
            "object_count": 0,
            "fonts": [],
            "xref_valid": True,
            "linearized": False,
            "encrypted": False
        }
        
        # Count %%EOF markers (indicates incremental saves)
        with open(pdf_path, 'rb') as f:
            content = f.read()
            structure["incremental_saves"] = content.count(b'%%EOF')
        
        # Parse object structure
        # Extract font references
        # Validate XRef table
        # ...implementation...
        
        return structure
    
    def compare_text_to_image(self, pdf_path: str) -> dict:
        """Compare embedded text layer to OCR of image"""
        
        result = {
            "matches": True,
            "discrepancies": []
        }
        
        # Extract text layer
        text_layer = self.extract_text_layer(pdf_path)
        
        # Render to image and OCR
        image = self.render_to_image(pdf_path)
        ocr_text = self.ocr_image(image)
        
        # Compare key fields
        # Amount fields are most critical
        text_amounts = self.extract_amounts(text_layer)
        ocr_amounts = self.extract_amounts(ocr_text)
        
        for field, text_val in text_amounts.items():
            ocr_val = ocr_amounts.get(field)
            if ocr_val and text_val != ocr_val:
                result["matches"] = False
                result["discrepancies"].append({
                    "field": field,
                    "text_layer": text_val,
                    "ocr_value": ocr_val
                })
        
        return result
    
    def calculate_file_hash(self, pdf_path: str) -> dict:
        """Calculate multiple hashes for verification"""
        
        with open(pdf_path, 'rb') as f:
            content = f.read()
        
        return {
            "md5": hashlib.md5(content).hexdigest(),
            "sha256": hashlib.sha256(content).hexdigest(),
            "size": len(content)
        }