PDF with bizarre source code - can anything be retrieved from it?

Question

My boyfriend's brother committed suicide last weekend, and left behind a will... in the form of a damaged PDF. I've tried to repair it using the various online services, to no avail. Looking at the source code of the PDF, it's clear something very strange is going on. There are huge blocks of "ÿ" character repeating, and then bits of HTML, including a partial "mergeOptions()" JavaScript function, which looks like something one uses for autocomplete. How could this happen? The PDF ought to contain only a scan of the handwritten will. I understand PDF files can become corrupted during transfer from one device to another, but how could an HTML page have gotten mixed up into the source code? Also, it looks like a page which my boyfriend's brother might have consulted, as it's related to his job, but not something he would have included in his will.

It seems like repairing the file is a lost cause (have tried Foxit, Xpdf, GhostScript, and some other stuff), but is there no way to recover anything from it? In between the gibberish are blocks of code which resembles PDF code. But even when I remove the gibberish and add PDF headers to the source code, the PDF appears as a blank page.

Also, is there any explanation for what could have happened to this file? It's just baffling. The file was on a hard drive, so at first we thought it could have been corrupted during transfer from the laptop to the hard drive. But we've now recovered the file from the laptop as well and it is exactly the same.

Any help/advice would be greatly appreciated, thanks!!

Editing to add a sample of what the file contains:

ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿelse {
                        return false;
                    }
                };
        }
        if (options.categories !== undefined && options.categories instanceof Array) {

            var categories = [];
enter code here

ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿU¢¢JGƒ€èZ    m[R}h‹—Ø$îõø»Ýïuâ;>ïØÂÍ šŒé¿‡÷£6ëÅÕ~            4;²Õ •j,Mîîî¼i_Uš            Ö÷¿“È#æU­¼A·ñ€ŠïØi™[/±P‡¸cßé]_{×̵æ %»Ù¹²” C>{üŸ6¹0CWá½€!ÿÿÿò—Š‹D ä>•wœn\ L’ê+ÙDD{99DqBúž²">H¾»lÌ/ÏéÝw×9\UÅ?Øý ÍÕ[nò­•b«Ú6'±ºþbÛ6ÞA±| Z0% ðô,à¤MûèÓ86/™¸Ù$\É|n‘8çcZ
áá Ó^½9šæ
4œA8®Âö¸.ÙÒ;lk8œ»
vú~þÿ{¾Äéôø¿ŽþÏZÑüv‹ù1Þý;uõüWÑxVÎßó(­ŸÎ÷åµméÖΟ hN½Ç>‚Îf“™¯…7Ü?÷ÿÓÿp>çþŸoíûÿÿÿà ¼è€í:!”õăb@Ùhr@(¥áíËÌó@Æm•¨®6®ÛÔØ[³¹‰(ײ»®äM1ÈÖßþ÷—Ô,¬7…^½T &Ðh?JáG¢=ìÒk8ƒìY I¡Ì¹°è°»?*s´ëœüTYÒ‹Aß'arO(ÌëÁ˜/HÉ;ˆ³çI80}ÎÐx6Ãç~üeÿ»'Qïµ]ø'«ü÷ﱺ '.îÞ¯õ ÿ +ùû¹ééÏÑ÷ß }wû¾BëxºŠþêúú.ûÕÞ¬ïÿyêã¼ïžªï½Wî^¬;ÏWÕûÿWï»ÓÕÃîù꾯ßw ð>qÀ UAš 3Æa)B®¾¿ÿóÙ&ÅžO_ÿõ/þ&‹ßd$ÙZÐŒ}Õ§Õj÷ר)Ö’š„Îô«Y. ®¼²ÞYR¿o–aDj.k1g¬üÛÆ‚o¿‘5¡OúÅú÷àœµN¤ñ8¿šÓ­Ò”^7ùÄÔöf£_˜bJëUŸ¬¥nÚþN›u¥†ÿ—+ÿÉB_©¼¨& ùÝõ“ä‚NïÛòAml·¿V‰P„/²Fm?Ýô½V/QŸw{ösì×ÙÕú4Óo‹ts„Ì,ÜŠ5õ?Ó4ë°ˆz™:ź~ËÝ¡='–«ðÇAFì}{æ¯âü®²ü°ß{_a;ß»òÍwß—¶è¿áF †6ÒéAÔÔÛ¦ZZºº©HWY;¯`LA/Z%¼ƒEFhzm˜Bôû÷7‹ÿA#Yá±2ÕË5K-uJÇnõ'Tõß(´$T:{á³Ü¾6fI¤Ó¾—©$Ïýœÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

The JavaScript is just there that one time. After that there are alternating blocks of the ÿ character and the kind of code shown above. The file starts and ends with the ÿ blocks. I shortened them in this snippet - they're actually much longer.

I don't know if this is the right way to share the file but here it is:

https://1drv.ms/b/s!AnGtFF6JZrtsgWSEYq_UiU7ib0rQ?e=xJpgFg

Thank you guys so much for all your help already, I'm honestly so moved. A violent death is a horrible thing.

Answer 1

IF there's a JPEG in there still encoded as JPEG you should be able to get out like so:

1. Grab a copy of JpegSnoop
2. Drop the file on there
3. Ignore complaint of the tool
4. Tools > Image search fwd

---

EDIT

Now having had the opportunity to look at the file:

With an entropy of 0.99 the file can hardly contain any data, even from a flat text file you expect higher entropy. The higher the entropy, the more data in general, while zero entropy would mean no data at all. This is a quick way to assess how much useful data a file can accommodate.

I work with, recover and repair JPEG data every day and I feel confident in stating you file contains no JPEG data at all, not even fragments.

In all likeliness, the file you currently have is as good as useless.

So rather than a repair case, this is a case where you can try to see if you can recover the file. I'd therefor:

• either consult with a data recovery specialist or find a community where such people hang out, suggestion: www.reddit.com/r/datarecovery/.
• what you could do yourself is image the drive you got the file from: look into ddrescue.
• Once you have the image file, put the drive aside and work with the image file exclusively.
• use file recovery software and determine if perhaps deleted versions of the document are recoverable.
• if that yields no results, a tool like PhotoRec could try recover each and every PDF file on the drive.
• since at some point a photo of a physical document was taken, you might also consider expanding the search towards JPEG files and see if the JPEG that was later embedded into a PDF file still exists somewhere.

Answer 2

First of all, sorry for your loss.
Having to face a data-recovery problem on top of that is really unfortunate.
And I know exactly how it feels. I had a similar situation with the broken hard-drive in my uncles laptop after his demise.

This feels like a case of hard-drive damage that happened AFTER the PDF was created and BEFORE you first tried to read the file.
Seems chkdsk or some other recovery tool "repaired" the problem but in doing so merged the PDF with other, random, unrelated data (browser cache content probably).
This is not unusual. No automated repair solution is 100% accurate. But it really sucks in this case.
The ÿ characters are another indicator of this. This is unicode 0x00FF and a repeating pattern of 00 and FF bytes is often the default content of an empty disk-block. If that gets linked into the file by chkdsk during the repair this is what you typically get.

What makes matters worse is that the PDF probably contained an embedded image (JPG probably) if it held a scan of a paper document. (PDF's can't store binary data natively, it is purely a vector format. Binary data is always embedded as a blob in another format. For images usually as a JPEG or sometimes PNG or TIFF.)
So even if you can somewhat repair the PDF headers you're still dealing with the corruption in the embedded image. Repairing that (with parts of the image missing/overwritten as well) is next to impossible as most image formats have internal compression and repairing a damaged compressed file is several orders of magnitude more complicated than an uncompressed file.

So I'm afraid this PDF is a loss.

However maybe not all is lost.

Go through that entire computer to see if another copy is lurking around (cache/temp folders). If there are backups see if they go back until before the corruption happened.
Also look at each image file you can find. If the will was scanned there is a high chance it was saved in some image format somewhere before it was imported in the PDF file.
Also check word-processing documents (doc, docx, etc). It is possible the PDF was originally in Word or Wordpad and then "saved as PDF". The original file might still be around, maybe under a different name.
(In my own case I found 3 Word documents called Untitled.docx having relevant data. My uncle saved them, but never bothered to give them a proper name.)

Also think of online storage. If the PDF got backup-ed there (e.g OneDrive) it could be a previous, good version is still available through the version history there.
Also check (online) photo-storage on his phone. Possible that the "scan" was originally a photo of the paper document and that photo is still around.