Can text under a redaction be recovered?

A page is a list of drawing instructions

A PDF page is a content stream: operators executed in order, from the first to the last. Text is drawn inside a text object, which opens with BT and closes with ET. Between them Tf picks a font and size, Td sets a position, and Tj draws a string. A rectangle is two operators: re adds it to the current path and f fills it with whatever colour rg last set.

Here is the entire content stream of a 637-byte PDF built for this page. It looks, on screen, like a line of text with a black bar across it.

BT
/F1 14 Tf
72 700 Td
(Account number 4029 1174 5583 9920) Tj
ET
0 0 0 rg
68 694 260 24 re
f

Handed to pdf.js 4.10.38, the same engine version this site serves to X-RAY and SEAL, getTextContent() on that page returns Account number 4029 1174 5583 9920. Nothing removed the Tj. The rectangle is drawn afterwards, and later operators paint over earlier ones rather than deleting them, so the string is exactly where it was. Select the area in any reader and the same thing happens: the reader is reading the operators, not the picture.

Kerned text hides nothing either. The TJ operator takes an array of strings with numbers between them for spacing, so a name can be split across several pieces. A stream containing [(Wit) 20 (ness: Mar) -15 (ia Delacroix)] TJ comes back from the same call as Witness: Maria Delacroix, reassembled the way the renderer would have assembled it.

Four more ways a redaction fails

The box is an annotation, not part of the page

Many editors draw their black box as an annotation: a separate object listed in the page's /Annots array. In a second fixture the box is object 6, << /Type /Annot /Subtype /Square /Rect [68 694 328 718] /IC [0 0 0] >>, and the content stream is untouched. Removing one entry from an array puts the page back to how it was. Flattening stops that particular trick, because it burns the appearance into the page and drops /Annots, but it never touches the text underneath, and it should not be mistaken for redaction.

A picture drawn over is still a picture

On a scanned page, the thing being covered is usually an image, and the image is a separate object with its own stream. A fixture here holds << /Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceRGB /BitsPerComponent 8 >> drawn with /Im0 Do, then a filled rectangle over half of it. Reading the stream straight out of the file, without looking at the page at all, gives back 255 0 0 · 0 255 0 · 0 0 255 · 255 255 0: the original samples, in order, unaffected by anything painted on top.

The file still says what the document was about

The trailer's /Info dictionary and the document outline are not page content, so no amount of drawing covers them. A fixture with a rectangle over a witness's name still answers getMetadata() with Title: Delacroix statement FINAL unredacted.docx and Author: J. Okonkwo, and its outline with a single bookmark: Statement of Maria Delacroix. The same names turn up in XMP packets and in the file name itself.

Earlier versions of the file are still inside it

A PDF is changed by appending to it. The editor writes the new objects at the end, then a new cross-reference section whose trailer carries /Prev, the byte offset of the previous one. Both revisions are in the same file; a reader follows the chain from the last startxref and shows you the newest.

Taking the fixture above and appending a revision that replaces the content stream with (Account number [REDACTED]) Tj produced an 860-byte file with two %%EOF markers, whose new trailer reads /Prev 454. pdf.js now reports Account number [REDACTED]. The string 4029 1174 5583 9920 is still in the file, at byte offset 312. Nothing was deleted; something was added in front of it.

This is the chain PDFSIG walks when it examines a signed document: it finds the last startxref, reads the trailer, follows /Prev back through every revision, cuts the file at each %%EOF and lists what each revision changed. Run a file you thought was clean through it and count the revisions.

What removing the content actually takes

There are two honest approaches. One is surgical: take the glyphs out of the content stream, take the image out of the resources, clear the metadata and the outline, then write the whole file out fresh so no earlier revision survives. It keeps selectable text everywhere else, and it is fiddly, because a text run has to be split around the part that goes and the positioning around it has to still make sense.

The other is to throw the structure away: render each page to a bitmap, destroy the pixels that should not be there, and build a new document out of the painted bitmaps. Nothing from the content stream, the annotations, the fonts, the metadata or an earlier revision survives, because none of it is carried across.

SEAL takes the second route, and it is worth being precise about what it does. Each page is rendered with pdf.js at twice its natural size, the areas you drag are filled black straight into that canvas with fillRect, and each painted canvas is encoded as JPEG and embedded as a new page. The output's title, author, subject, keywords, producer and creator are set to empty strings rather than left to the library, and the SHA-256 of the bytes you downloaded is shown so the file can be identified later.

The cost is stated rather than hidden: the result is images. Text in it is no longer selectable or searchable, and the file is larger than the original. That is the mechanism, not a side effect. A redaction that kept the text layer would not be a redaction.

PDF Studio, which is part of OBSCURA Pro, takes the surgical route. Every letter under a mark is taken out of the page's own drawing instructions, invisible letters included, so an OCR layer goes too; the pixels of a picture under a mark are painted in the picture itself; links, notes and form fields there are removed; bookmarks that name what was searched for are renamed; and the search is run again afterwards to show that nothing it was looking for is left. The rest of the page stays selectable text. Its limits are on its page: a line or filled shape under a mark is painted over rather than removed, and a fax or JBIG2 scan, whose picture it cannot edit, becomes a picture of the page with the box painted in.

What to do with a document you are about to send

• Look at it before you decide. X-RAY renders each page, then compares every text run against the pixels where it should be. It sorts those pixels into sixteen brightness bands: rendered glyphs are anti-aliased and spread across many bands, while a flat fill lands entirely in one. Text the file contains but the page does not show is reported. It is a heuristic and it says so, because a scanned page with an OCR layer is invisible text by design; when nearly all of a page's text is invisible X-RAY calls it OCR rather than a failed redaction.
• Redact by rasterising. SEAL, above. One file at a time, marked by hand.
• Or redact surgically, keeping the text. PDF Studio, above, with Pro: marks by hand, or by searching for email addresses, telephone, National Insurance and card numbers, IBANs, sort codes, postcodes, dates, your own words or an expression of your own.
• Deal with forms and comments separately. FLATTEN draws each form field's value permanently onto the page and removes the field, so there is no second, editable copy of the answers to read out. It also removes fields marked hidden before it draws anything, rather than printing across the page a value somebody had made invisible, and it deletes the catalogue's XMP metadata stream as well as the /Info fields.
• For disclosure work, the discovery walkthrough covers the order to do these in and the chain-of-custody side.

What this does not tell you

None of the checks here find sensitive content for you. SEAL removes what you cover and nothing else; X-RAY reports what a page contains and does not judge whether it should, and its hidden-text pass stops after the first twelve pages. Headers, footers, margins, the second column and page 40 are yours to read.

Rasterising defeats extraction from the file. It does not defeat reading the picture: if a rectangle is too small, or is drawn at the wrong place because a viewer laid the page out differently, the pixels that show through are simply visible. Check the preview.

And an image-only PDF is not anonymous. The library that writes it stamps a /CreationDate and a /ModDate at the moment of export whatever else has been cleared, and the file still has a size and whatever name you give it.