BASALT · JOURNAL
Why incremental PDF saves matter for security
A PDF can be updated without rewriting the whole file. The application appends changed objects and a new cross-reference section, and the viewer follows the newest version. This is efficient and useful for signatures, but it can leave superseded content in the bytes.
How incremental updates work
PDF objects have identifiers. During an incremental save, a changed page or annotation can be written again near the end of the file while the earlier object remains. A chain of trailers points readers through the revisions.
The current view is not the same as physical erasure. A parser or forensic tool may recover an old string, image, comment, or metadata value that the viewer no longer displays.
Why redaction needs a clean rewrite
If a tool removes a name from the current page object and appends that change, the original page stream can remain earlier in the file. A safe release should rebuild the document into one generation containing only approved current objects, then verify that no revision chain or target string remains.
“Save As” is not a universal guarantee. Some applications optimize or preserve history differently, so test the actual output.
How to inspect a file
Look for multiple startxref markers and trailers, but do not treat a simple byte search as complete analysis; streams can be compressed or encoded. Use a PDF-aware parser to enumerate revisions and objects, extract text from each reachable representation, and inspect the final structure.
Digitally signed PDFs intentionally rely on byte history, so rewriting them invalidates the existing signature. Preserve the signed original and create a separate sanitized derivative.
Frequently asked questions
Can deleted PDF text remain after saving?
Yes. Incremental saving may append a new state while leaving superseded objects in the original byte sequence.
Does “Save As” always remove PDF history?
No. Behavior varies. Verify that the output has one clean generation and that old objects or strings are absent.
Why do digital signatures use incremental updates?
They preserve the signed byte range and append signature-related data. Rewriting earlier bytes would break validation.
Doing it in Basalt
Basalt rewrites redacted output as one clean generation and its verifier rejects files with recoverable earlier revisions. Signed originals can be inspected and preserved while a separate derivative is produced. Get Basalt.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.