Document Examination
| Document Examination | |
|---|---|
| Also called | Questioned-document examination (QDE) |
| Object | Physical and electronic documents |
| Aims | Authenticate, date, attribute, detect alteration |
| Related | Digital Forensics, Evidence and Testimony |
Document examination — in its classical form questioned-document examination — is the forensic discipline that determines the authenticity, origin, authorship and history of a document, and detects alteration or forgery. It spans two increasingly connected domains: the physical analysis of paper, ink and impressions, and the electronic analysis of digital documents through their metadata and hidden content. In fraud investigation it is used to expose forged signatures, altered contracts, backdated agreements, fabricated invoices and manipulated financial records.[1]
The discipline sits alongside digital forensics and, like it, depends on strict chain of custody and on methods that will survive scrutiny under the reliability standards for expert testimony.
1 Physical examination and microscopy
The starting point is direct optical examination. Under magnification — from a simple loupe to a stereomicroscope — an examiner studies the way ink sits on paper, the sequence in which crossing lines were written, printing-process artefacts, erasures, and mechanical alterations. Microscopy can reveal, for example, that two entries on a ledger were made with different pens, or that a figure was overwritten. It also distinguishes genuine printing (offset, laser, inkjet) from photocopies and reveals the tell-tale toner or dot patterns each process leaves behind (general knowledge).
2 Spectral and hyperspectral imaging
Many features invisible under ordinary light appear under other parts of the spectrum. Ultraviolet (UV) illumination makes security features, optical brighteners in paper, and some alterations fluoresce, and can reveal where an original coating has been disturbed. Infrared (IR) imaging exploits the fact that visually similar inks often differ in their IR absorption or luminescence: an addition made with a different ink, though the same colour to the eye, can stand out sharply in the infrared, exposing insertions and alterations.[2]
Hyperspectral imaging extends this idea by capturing an image across many narrow spectral bands at once, producing a spectral "fingerprint" for each point on the page. This allows inks that are indistinguishable to the eye and even to conventional IR to be separated, and can help establish that different portions of a document were written with different inks — a common indicator of alteration or of text added after the fact.
3 Indented-impression analysis
When someone writes on a pad of paper, the pressure of the pen leaves latent indentations on the sheets beneath. Indented-impression analysis recovers this writing from a page that appears blank. The classic instrument is the electrostatic detection device (ESDA), which develops the indentations without damaging the document, allowing an examiner to read what was written on a now-missing page above — often revealing the true sequence in which pages of a set were prepared, or content the author never intended to be recovered (general knowledge).
4 Ink dating and chemistry
A frequent question in fraud cases is when an entry was made — whether a document was genuinely signed on its stated date or backdated. Ink dating attacks this through chemistry. Analytical methods include:
- Thin-layer chromatography (TLC) — separates the dyes and components of an ink, giving a compositional profile that can distinguish one ink formulation from another.
- High-performance liquid chromatography (HPLC) — a more sensitive separation technique used to measure ink components and, in some approaches, the ageing of solvents in the ink over time.
- Mass spectrometry — identifies the specific chemical constituents of an ink with high precision, often coupled to a chromatographic separation.
- Raman and infrared (IR) spectroscopy — non-destructive vibrational techniques that characterise inks and pigments in place, useful for comparing whether two marks share the same formulation.
Two broad strategies exist: static comparison, which asks whether an ink's formulation is consistent with (or existed at) the claimed date, and dynamic analysis, which measures the ongoing evaporation or drying of solvents to estimate how long ago a line was written. Ink dating is genuinely difficult and contested; results are usually expressed as ranges or consistency findings rather than exact dates, and examiners are careful to state these limits — a caution reinforced by the Daubert reliability standard.[2]
| Technique | What it measures | Destructive? |
|---|---|---|
| TLC | Ink dye/component profile | Yes (small sample) |
| HPLC | Component quantities; solvent ageing | Yes (small sample) |
| Mass spectrometry | Precise chemical composition | Usually (sample) |
| Raman / IR spectroscopy | Molecular fingerprint of ink/pigment | No (in situ) |
5 Signature and forgery analysis
Signature examination compares a questioned signature against known genuine specimens (exemplars). Examiners assess line quality, pen pressure, rhythm, letter forms, proportions and connecting strokes. Forgeries tend to betray themselves through hesitation, tremor, pen lifts, blunt starts and stops, and slavish tracing — signs that the writer was drawing rather than writing fluently. Common forgery types include simulation (copying a genuine signature freehand), tracing (following an underlying image), and freehand or blind forgery (inventing a signature). The reliability of handwriting comparison has itself been examined under evidentiary standards, and modern examiners frame their conclusions probabilistically and support them with documented features rather than bare assertion.
6 Electronic documents: metadata and steganography
Documents are now overwhelmingly born-digital, and their examination increasingly overlaps with digital forensics. Two areas are central:
- Metadata detection — office documents, PDFs and images carry embedded metadata: creation and modification dates, author names, software versions, revision history, and (in photographs) camera and GPS data. This hidden record frequently contradicts a document's apparent history — for instance, showing that a "contract dated 2019" was actually created last month, or that several supposedly independent invoices were authored by the same account within minutes of one another. Metadata is a powerful and easily overlooked route to detecting backdating and fabrication.
- Steganography detection — steganography conceals data within another file (hiding information in the low-order bits of an image, for example). Detection tools look for the statistical signatures that hidden payloads leave behind. In fraud and broader criminal investigation this matters where documents or images are used as covert carriers of exfiltrated data.
Because electronic evidence is fragile, examiners recover and analyse it from forensic copies under a documented chain of custody, and record the hash values that prove nothing was altered.
See also: Digital Forensics, Chain of Custody, Financial Statement Fraud, Evidence and Testimony.
References
- Dubey, Bhatt & Negi. "Digital forensics techniques and trends." International Arab Journal of Information Technology 20(4), 2023.
- AICPA / Crain, Hopwood, Pacini & Young. "Essentials of Forensic Accounting." 2015 (document examination and admissibility under Daubert).