Forensic Analysis of Digital Evidence

**Looking for a digital forensics expert — Apple Mail print-to-PDF, truncated attachment (macOS 14.x)**

I am a litigant in civil proceedings in England & Wales and need to instruct an independent expert on a narrow technical point.

In short: I have two PDFs, both produced by Apple Mail's print-to-PDF (Quartz PDFContext, macOS 14.5 and 14.6.1), of the *same* email carrying the *same* single-page PDF attachment. I also have the original `.eml`.

In one, the attachment appears as an icon and its full page is appended. In the other, the attachment is rendered inline and visually cut off after roughly the top eighth, with several centimetres of blank printable page below the cut. The content stream shows a clipping path substantially smaller than the content it clips, and the hidden material is partly still present in the file and partly absent from it.

The question I need answered is whether that truncation is an artefact of Mail's layout — there are published reports of similar behaviour — or whether it required some act by the person who produced it. I want both possibilities tested even-handedly rather than either assumed.

What I am after:

- someone comfortable at PDF content-stream level **and** with macOS internals;
- ideally with access to a machine that can run macOS 14.5 (build 23F79), because reproduction is the crux;

I have already done a fair amount of my own analysis — exact clip and transform values, geometry, font subsetting, image hashing, metadata — and can share a full technical note, along with the files, privately under an appropriate undertaking. I have kept identifying material out of this post deliberately.

Recommendations or expressions of interest very welcome. Happy to take a message.