pdforensic-authentic-check 0.1.0__py3-none-any.whl

pdforensic/__init__.py

@@ -0,0 +1,17 @@
+"""
+pdforensic - Lightweight PDF forensics utility wrapping pdfresurrect and other shell tools.
+"""
+
+from .retrieve_metadata import extract_pdf_metadata
+from .retrieve_all_versions import recover_pdf_versions
+from .check_versions import check_no_of_versions
+from .check_eof_markers import count_pdf_eof_markers
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "extract_pdf_metadata",
+    "recover_pdf_versions",
+    "check_no_of_versions",
+    "count_pdf_eof_markers"
+]

pdforensic/check_eof_markers.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+
+import argparse
+import re
+
+def count_pdf_eof_markers(pdf_path):
+    """
+    Count the number of %%EOF markers in a PDF file.
+    
+    Args:
+        pdf_path (str): Path to the PDF file.
+
+    Returns:
+        int: Number of %%EOF markers.
+        -1: If file not found or unreadable.
+    """
+    try:
+        with open(pdf_path, 'rb') as f:
+            content = f.read()
+
+        matches = re.findall(rb"%%EOF", content)
+        return len(matches)
+
+    except FileNotFoundError:
+        return -1
+    except Exception as e:
+        print(f"Error reading PDF: {e}")
+        return -1
+
+def cli():
+    """
+    Command-line interface for counting %%EOF markers in a PDF file.
+    """
+    parser = argparse.ArgumentParser(description="Count %%EOF markers in a PDF file")
+    parser.add_argument("pdf_path", type=str, help="Path to the PDF file")
+    args = parser.parse_args()
+
+    count = count_pdf_eof_markers(args.pdf_path)
+    if count == -1:
+        print("❌ Could not open or read the PDF.")
+    else:
+        print(f"Number of %%EOF markers found: {count}")
+
+if __name__ == "__main__":
+    cli()

pdforensic/check_versions.py

@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+
+import subprocess
+import argparse
+
+def check_no_of_versions(pdf_path):
+    """
+    Check the number of versions of a PDF file using the pdfresurrect tool.
+
+    Args:
+        pdf_path (str): The path to the PDF file.
+
+    Returns:
+        int: The number of versions found in the PDF file.
+    """
+    try:
+        result = subprocess.run(
+            ['./bin/pdfresurrect', '-q', pdf_path],
+            capture_output=True,
+            text=True,
+            check=True
+        )
+        output = result.stdout.strip()
+        if ':' in output:
+            parts = output.split(':')
+            version_str = parts[1].strip()
+            if version_str.isdigit():
+                return int(version_str)
+        print(f"Unexpected output: {output}")
+        return 0
+    except subprocess.CalledProcessError as e:
+        print(f"Error checking PDF versions: {e}")
+        return 0
+
+def cli():
+    """
+    Command-line interface for checking number of PDF versions.
+    """
+    parser = argparse.ArgumentParser(description="Check the number of PDF versions using pdfresurrect")
+    parser.add_argument("pdf_path", type=str, help="Path to the PDF file")
+    args = parser.parse_args()
+
+    versions = check_no_of_versions(args.pdf_path)
+    print(f"Number of versions found: {versions}")
+
+if __name__ == "__main__":
+    cli()

pdforensic/retrieve_all_versions.py

@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+
+import subprocess
+import argparse
+import os
+
+def recover_pdf_versions(pdf_path):
+    """
+    Recover previous versions of a PDF using pdfresurrect -w.
+    If previous versions are recovered, list them from the auto-created folder.
+
+    Args:
+        pdf_path (str): Path to the PDF file.
+
+    Returns:
+        str: Status message with recovered file listing if applicable.
+    """
+    try:
+        result = subprocess.run(
+            ['./bin/pdfresurrect', '-w', pdf_path],
+            capture_output=True,
+            text=True,
+            check=True
+        )
+
+        output = result.stdout.strip()
+        print(f"\n[pdforensic output]:\n{output}\n")
+
+        # Case 1: Only one version
+        if "There is only one version of this PDF" in output:
+            return "There is only one version of this PDF. No previous versions recovered."
+
+        # Case 2: Folder exists with recovered versions
+        base_name = os.path.splitext(os.path.basename(pdf_path))[0]
+        version_folder = f"{base_name}-versions"
+
+        if os.path.isdir(version_folder):
+            recovered_files = os.listdir(version_folder)
+            print(f"Recovered versions & summary text of change found in: {version_folder}/")
+            for f in recovered_files:
+                print(f"✔ {f}")
+            return f"Recovered {len(recovered_files)} version(s)."
+        else:
+            return "Warning: Recovery folder not found, although output indicated multiple versions."
+
+    except subprocess.CalledProcessError as e:
+        return f"Error recovering PDF versions: {e}"
+
+def cli():
+    """
+    Command-line interface for recovering PDF versions.
+    """
+    parser = argparse.ArgumentParser(description="Recover previous PDF versions using pdfresurrect")
+    parser.add_argument("pdf_path", type=str, help="Path to the PDF file")
+    args = parser.parse_args()
+
+    message = recover_pdf_versions(args.pdf_path)
+    print(f"\nResult: {message}")
+
+if __name__ == "__main__":
+    cli()

pdforensic/retrieve_metadata.py

@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+
+import subprocess
+import argparse
+
+def extract_pdf_metadata(pdf_path):
+    """
+    Extract PDF forensic metadata using pdfresurrect -i.
+
+    Args:
+        pdf_path (str): Path to the PDF file.
+
+    Returns:
+        dict: Metadata extracted from the PDF.
+    """
+    metadata = {}
+    try:
+        result = subprocess.run(
+            ['./bin/pdfresurrect', '-i', pdf_path],
+            capture_output=True,
+            text=True,
+            check=True
+        )
+
+        lines = result.stdout.strip().splitlines()
+
+        for line in lines:
+            if line.strip() == "":
+                continue
+
+            # Handle Version X -- Y objects
+            if line.startswith("Version") and "--" in line and "objects" in line:
+                metadata["object_summary"] = line.strip()
+                continue
+
+            # Handle key: value
+            if ":" in line:
+                key, value = line.split(":", 1)
+                metadata[key.strip()] = value.strip().strip("()")
+
+        return metadata
+
+    except subprocess.CalledProcessError as e:
+        print(f"Error extracting metadata: {e}")
+        return {}
+
+def cli():
+    """
+    Command-line interface for extracting PDF metadata.
+    """
+    parser = argparse.ArgumentParser(description="Extract PDF metadata using pdfresurrect")
+    parser.add_argument("pdf_path", type=str, help="Path to the PDF file")
+    args = parser.parse_args()
+
+    meta = extract_pdf_metadata(args.pdf_path)
+    print("Extracted PDF Metadata:")
+    for key, value in meta.items():
+        print(f"{key}: {value}")
+
+if __name__ == "__main__":
+    cli()

pdforensic_authentic_check-0.1.0.dist-info/METADATA

@@ -0,0 +1,14 @@
+Metadata-Version: 2.4
+Name: pdforensic-authentic-check
+Version: 0.1.0
+Summary: A simple PDF forensic toolkit using pdfresurrect and bash utilities
+Author: Alex Mkwizu
+Author-email: alexgmkwizu@gmail.com
+License-File: LICENSE
+Provides-Extra: dev
+Requires-Dist: pytest; extra == "dev"
+Dynamic: author
+Dynamic: author-email
+Dynamic: license-file
+Dynamic: provides-extra
+Dynamic: summary

pdforensic_authentic_check-0.1.0.dist-info/RECORD

@@ -0,0 +1,11 @@
+pdforensic/__init__.py,sha256=ZV5dgxExgr1GY2i70jnRHgL-gyjWo9-nWghfbOSPyX0,461
+pdforensic/check_eof_markers.py,sha256=0hvzZAxCNzRHAKSLVFcQFO5RpiNqy-yDsNslpJpJwHA,1125
+pdforensic/check_versions.py,sha256=3-MHH4hhZLei59YnIVjlNQmss5N23D0KIppAwIPCmMU,1349
+pdforensic/retrieve_all_versions.py,sha256=TSqjqdMOYym0Yebd0yIIm9mDJggGTyGX_L3T2786wvw,2009
+pdforensic/retrieve_metadata.py,sha256=836zuTw1mrVDU4TcKZNCNlI38FKq1-H4ANg7Bwgwtz0,1626
+pdforensic_authentic_check-0.1.0.dist-info/licenses/LICENSE,sha256=y_53LQFJ-g-6uwPkCGVcT3LhYFuUTcTdGvz90fIBpBE,1068
+pdforensic_authentic_check-0.1.0.dist-info/METADATA,sha256=VH14hMtw9PI0JWq_DXwT23vXdUPbZOBnDNloJHGLTpc,384
+pdforensic_authentic_check-0.1.0.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+pdforensic_authentic_check-0.1.0.dist-info/entry_points.txt,sha256=X9i8BZxZyBDkHSeQIRStjf-o5tzpXrf1O5MhmH5zXj8,201
+pdforensic_authentic_check-0.1.0.dist-info/top_level.txt,sha256=9JthI2_jEtlj_ZvJHod_UI6nISUJYfyS52wqjwfOj6I,11
+pdforensic_authentic_check-0.1.0.dist-info/RECORD,,

pdforensic_authentic_check-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (80.9.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

pdforensic_authentic_check-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,5 @@
+[console_scripts]
+pdf-eof = pdforensic.check_eof_markers:cli
+pdf-meta = pdforensic.retrieve_metadata:cli
+pdf-recover = pdforensic.retrieve_all_versions:cli
+pdf-versions = pdforensic.check_versions:cli

pdforensic_authentic_check-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Alex Mkwizu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

pdforensic_authentic_check-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+pdforensic