I got the sample, thanks.
Using "exiftool -v" on this file, I see a signed annotation with the
information below.
The signature time is given by M. It could be that the digest is given by
DigestValue, but this is an MD5 digest, not sha256.
It would be tricky to extract this information in a meaningful way because it
is not document-level metadata. It seems that these signatures are associated
with form fields, and as such there may (presumably) be a number of signatures
at various locations in the document.
I'm hoping that the -v option will be good enough to get the information you
are looking for.
- Phil
| | | 10) T = (Signature2)
| | | 11) Type = /Annot
| | | 12) V (SubDirectory) -->
| | | + [V directory with 9 entries]
| | | | 0) ByteRange = [0,261028,278888,24927]
| | | | 1) Contents =
<30821a4406092a864886f70d010702a0821a3530821a31020101310f300d0[snip]
| | | | 2) Filter = /Adobe.PPKLite
| | | | 3) M = (D:20160220012731+11'00')
| | | | 4) Name = (x...@xxxx.net) [email address blanked for your privacy
- PH]
| | | | 5) Prop_Build (SubDirectory) -->
| | | | + [Prop_Build directory with 3 entries]
| | | | | 0) App (SubDirectory) -->
| | | | | + [App directory with 5 entries]
| | | | | | 0) Name = /Adobe#20Acrobat#20Reader#20DC
| | | | | | 1) OS = [/Win]
| | | | | | 2) R = 985600
| | | | | | 3) REx = (2015.010.20059)
| | | | | | 4) TrustedMode = true
| | | | | 1) Filter (SubDirectory) -->
| | | | | + [Filter directory with 4 entries]
| | | | | | 0) Date = (Dec 18 2015 15:42:30)
| | | | | | 1) Name = /Adobe.PPKLite
| | | | | | 2) R = 131104
| | | | | | 3) V = 2
| | | | | 2) PubSec (SubDirectory) -->
| | | | | + [PubSec directory with 3 entries]
| | | | | | 0) Date = (Dec 18 2015 15:42:30)
| | | | | | 1) NonEFontNoWarn = true
| | | | | | 2) R = 131105
| | | | 6) Reference (SubDirectory) -->
| | | | + [Reference directory with 7 entries]
| | | | | 0) Data = ref(12 0 R)
| | | | | 1) DigestLocation = [279309,34]
| | | | | 2) DigestMethod = /MD5
| | | | | 3) DigestValue = <c3c345ffe3fc662452320bd663396336>
| | | | | 4) TransformMethod = /FieldMDP
| | | | | 5) TransformParams (SubDirectory) -->
| | | | | + [TransformParams directory with 4 entries]
| | | | | | 0) Action = /All
| | | | | | 1) P = 1
| | | | | | 2) Type = /TransformParams
| | | | | | 3) V = /1.2
| | | | | 6) Type = /SigRef
| | | | 7) SubFilter = /adbe.pkcs7.detached
| | | | 8) Type = /Sig
