Can opening a PDF get me hacked?
Yes. Standard PDF readers like Adobe Reader execute JavaScript, launch URLs and run embedded actions automatically when you open a file. A malicious PDF can exploit these features to download malware, steal credentials or redirect you to phishing pages. Sherlock Forensic PDF Viewer + Editor parses PDFs with a pure Rust parser that does not execute any embedded code. Visual rendering via pdfium only happens when you explicitly click Render after reviewing the Threat Inspector.
Why is this called a forensic PDF editor?
Because it treats every PDF as potentially hostile evidence. The safe-by-default architecture (Rust parser first, pdfium render only on click) mirrors how a forensic examiner handles suspect files: inspect metadata and structure before ever executing content. The Threat Inspector extracts URLs, JavaScript, launch actions, embedded files and phishing indicators so you see what the PDF wants to do before it can do it.
Do you collect any data or telemetry?
No. Sherlock Forensic PDF Viewer + Editor makes zero outbound network connections. No telemetry, no analytics, no license-phone-home, no update checks. The application is a single .exe that runs entirely offline. Your PDFs never leave your machine. Verify with
Wireshark or any network monitor.
How is this different from opening a PDF in a sandbox?
A sandbox lets the malicious code run and tries to contain the damage after the fact. Sherlock never runs the code in the first place. The Rust parser extracts text, structure and metadata without executing JavaScript, launch actions or embedded scripts. You see the threats listed in the Threat Inspector before any rendering occurs. It is prevention vs containment.
What happens if I open a malicious PDF in Sherlock?
Nothing fires. The file is parsed by lopdf (pure Rust) which extracts structure without executing anything. The Threat Inspector scans every URL, JavaScript action, /Launch action, /OpenAction, embedded file and XFA form. Critical threats trigger a red banner and rendering is blocked. You can read every script in the JavaScript Inspector panel and inspect every URL it would have called. The script body is just text in the UI. No JS interpreter runs. No URLs are fetched. No shell commands are handed to the OS. No annotation actions fire on click. Two layers of defense: lopdf has no action dispatcher and pdfium (when engaged) only rasterizes bitmaps without calling FORM_DoDocOpen or any event handler.
Can Sherlock detect hidden text in a PDF?
Yes. The Hidden Text panel in the Forensic Inspector detects text rendered with mode 3 (invisible). This is text that exists in the content stream but is not displayed on the page. It is commonly used to hide keywords for search engine manipulation, embed tracking strings or conceal watermarks. Sherlock surfaces every instance with its position and content so you can see what the document is hiding.
How do I scan a folder of PDFs for threats?
Open Sherlock Forensic PDF Viewer + Editor and use the Batch Scan feature. Select a folder and every PDF inside it is scanned automatically. The results appear in a summary table showing threat count, severity and file details for each PDF. Sort by severity to prioritize the most dangerous files. Click any row to open the full Forensic Inspector for that file. This is designed for IR triage: point at a folder of seized PDFs or email attachments and get an instant threat overview.
What forensic metadata can Sherlock extract from a PDF?
The Forensic Inspector has 22 panels that extract: document identity (PDF version, encryption, trailer /ID), file hashes (SHA-256, MD5) with blocklist matching, permissions (/Encrypt /P analysis), PDF/A and PDF/X conformance, /Info dictionary (author, producer, creator, dates), XMP metadata with full edit-tool history, incremental save timeline (every %%EOF with byte offset), fonts (PostScript name, subtype, embedded status), embedded files (name, size, MIME, hash), JavaScript (beautified and syntax-highlighted), actions chain (/OpenAction, /AA, annotation /A), URLs with phishing analysis, hidden text (render mode 3), layers (OCGs), structure tree, cross-reference table and leaked filesystem paths.
Can Sherlock detect failed redactions in a PDF?
Yes. The Redaction Lie Detector finds text that is recoverable from underneath redaction rectangles or dark highlight annotations. When someone tries to redact a PDF by drawing a black rectangle over text, the text remains in the content stream. Sherlock recovers it and shows the hidden text alongside the cover rectangle coordinates. This is critical for court documents, leaked contracts and any case where someone attempted to hide information but failed.
How does Sherlock detect if a PDF was tampered with?
The Tampering Signatures feature runs 14 forensic tells in parallel: ModDate not advanced after save, CreateDate mismatch between XMP and /Info, Producer mismatch, signature timestamp predating creation, annotation back-dating, hidden OCG layers, unused embedded fonts, JBIG2 presence, duplicate xref offsets and more. Each finding includes a severity rating, plain-English explanation and raw evidence. This proves document alteration in cases where integrity matters.
What is the Forensic Narrative Engine?
The Forensic Narrative Engine auto-generates a plain-English paragraph summarizing the forensic state of a PDF. It produces output like: "This document was created on 2024-03-15 by Microsoft Word 16.0, modified 4 times across 12 days, the XMP edit history records Adobe Acrobat Pro DC as last editor though Producer claims LibreOffice 7.5." A copy-to-clipboard button lets investigators paste directly into case notes. No other PDF tool generates this automatically.
What is the safest PDF viewer for Windows?
Sherlock Forensic PDF Viewer + Editor opens PDFs in a pure Rust parser that cannot execute JavaScript, navigate URLs or launch processes. The rendering engine (pdfium) only activates when you click Render Pages. No other PDF viewer separates parsing from rendering this way. The Threat Inspector scans for malicious URLs, JavaScript, launch actions, embedded files and phishing indicators before a single pixel renders. Zero network traffic. Single .exe. Free download.
Is there a secure PDF viewer that scans for malware?
Yes. Sherlock Forensic PDF Viewer + Editor scans every PDF for malicious URLs, JavaScript, launch actions, embedded files and phishing indicators before rendering a single pixel. The Threat Inspector shows you what the PDF wants to do. Nothing executes. Unlike antivirus which scans for known signatures after download, Sherlock performs structural analysis that catches zero-day exploits. Free for Windows.
Why does Windows SmartScreen warn about this app?
SmartScreen flags executables that have not accumulated enough download volume to build a reputation score with Microsoft. This is normal for new independent software and has nothing to do with the safety of the application itself. Sherlock Forensic PDF Viewer + Editor is a single Rust binary with no network access, no installer and no system modifications. You can verify the SHA-256 hash on the download page and inspect network traffic with Wireshark to confirm zero outbound connections.
