Change one number in a contract, receipt or certificate and its meaning changes completely. Two files can look identical on screen while one of them records when, with which program and how many times it was edited — and that history is often what gives a forgery away.
When a PDF is edited it is often saved incrementally: new content is appended instead of overwriting the old, so earlier versions and several save points can remain inside the file. In a digitally signed PDF you can also see what changed after signing. Origma reads this structure and records post-signature changes and repeated saves.
Word documents (DOCX) leave a revision ID (rsid) per editing session and can carry tracked changes, authors and timestamps. If one paragraph was changed in a different session, that can show. Because this information can be removed or altered, we use it when present — its absence does not mean the document is original.
Hangul documents record the program version, author, save time and the list of fonts used. A font that differs from what an official form normally uses, appearing in only one part, or a save time that does not fit the issue date, gives you something to examine. Origma reads HWP and HWPX metadata into the ledger.
Origma reads the structure and history inside the document file; it does not check authenticity with the issuing authority. A document printed and scanned again loses its file history. Results are probabilistic assessments, not certified forensic reports or legal proof — confirm important documents with the issuer and an expert.
This is general guidance, not legal advice. A scan result is a probabilistic assessment, not proof.