I followed a link on Twitter to InDesignSecrets and read an interesting post on embedded links in Adobe InDesign.
What I found particularly interesting was this question that David Blatner added to the tutorial:
(One thing I do find odd: The file that it unembeds and saves to disk is usually a slightly different file size than the file that was placed. I don’t understand this. The data is not changing—the image is exactly the same, even if you compare pixel to pixel in Photoshop. Even metadata seems to still be there. I know it’s a silly thing, but can anyone spot what’s different?)
This looked like a perfect Adobe forensic question! I did some testing, and although I am not entirely sure why this is, here is what I found:
I made a blank InDesign document in InDesign CC 2015 and placed an Illustrator graphic (tcfc-logo.ai). I embedded the link and then unembedded it into a new folder.
I checked both the original file and the unembedded copy with OnlineMD5.com. The MD5 hash values were the same, indicating that the files were identical (see Figure 1).
I then checked each file with Mac’s Get Info function from the Finder. Here’s where things changed. The original file was 366,692 bytes and the unembedded version was 366,631 bytes—a difference of 61 bytes (see Figure 2).
Why the difference? I’m not entirely sure. The only difference I can see is that the unembedded version strips out the “Version” info from the Get Info panel. It’s possible that the Finder is creating the difference in its reporting, but not changing the file size from original to unembedded.
I’m not sure if Mr. Blatner found the discrepancy the same way I did or not. But, at least, it was an exciting forensic challenge.
I just finished my Capstone Project for the Master of Science Program in Cybersecurity and Computer Forensics at Utica College and titled my paper, The Malicious and Forensic Uses of Adobe Software. This was a perfect opportunity to put some of what I learned to the test.
Thank you, Mr. Blatner, for a great article.