A Simplified Guide To Forensic Document Examination

Preparing to load PDF file. please wait...

0 of 0
100%
A Simplified Guide To Forensic Document Examination

Transcript Of A Simplified Guide To Forensic Document Examination

A Simplified Guide To Forensic Document Examination

Introduction
An abundance of crucial information can be gleaned from documents related to a criminal or civil case. The suicide note found next to the deceased—was it actually written by a killer trying to cover up his crime? The bank robber’s hold-­‐up note—does it contain invisible impressions that indicate the address of the hideout? The will of a wealthy person—was it altered so a relative could receive a windfall?
The discipline of forensic document examination, often referred to as “questioned documents,” is frequently associated with white-­‐collar crimes such as check fraud; however, in practice, this area of forensic science can be used in a wide array of cases from medical malpractice to art forgeries to homicides.
Armed with sophisticated technology, forensic document examiners can peer into the visible and invisible marks on a document to extract an abundance of details that may verify authenticity or provide additional information crucial to the investigation.
The digital age has made the work of forensic document examiners even more important. With the availability of powerful software programs such as Adobe® Photoshop®, Acrobat® and others, it has become significantly easier for criminals to create and manipulate all manner of fraudulent documents from contracts to currency.
Principles of Forensic Document Examination
Forensic document examiners often deal with questions of document authenticity. To determine whether a document is genuine, an examiner may attempt to confirm who created the document, determine the timeframe in which it was created, identify the materials used in its preparation or uncover modifications to the original text.
Documents can be examined for evidence of alterations, obliterations, erasures and page substitutions. Or the examiner can study the methods, materials or machines that created the document, providing key information that can identify or narrow the possible sources of the document. The ink, paper, writing tools, ribbons, stamps and seals used in production of the document may all reveal important clues. The examiner may even discover valuable evidence in a document’s invisible impressions.

A key element of document examination focuses on handwriting. Forensic examination and comparison of handwriting, which includes hand printing and signatures, is based on three main principles: (1) Given a sufficient amount of handwriting, no two skilled writers exhibit identical handwriting features; (2) every person has a range of natural variation to his or her writing; (3) no writer can exceed his or her skill level (i.e., it would not be possible for a marginally literate person who has only learned to produce very basic hand-­‐printed letters to execute perfectly formed, highly skilled cursive writing).
Computer databases maintained by the U.S. Secret Service, German Federal Police and Federal Bureau of Investigation contain handwriting samples from hundreds of thousands of writers. Comparisons of these databases have not identified two individuals who have the exact same combination of handwriting characteristics, adding to the authenticity of handwriting as a solid form of evidence.

Why and when is forensic document examination used?

Since documents are part of daily life, forensic document examiners work a wide variety of cases. Forensic document examiners are called to investigate the authenticity of documents in situations such as:

• forgeries • counterfeiting • identity theft • fraud • suicides • homicides • bank robberies

• kidnappings • extortion • stalking • contested wills • contested contracts • medical malpractice • title/deed lawsuits

Forensic document examiners are most frequently asked to resolve questions of authorship. Is the signature on the mortgage loan genuine? Who wrote the anonymous note? Did the deceased sign the will? By comparing documents found at a crime scene to a suspect’s known writing samples, the forensic document examiner can help confirm who wrote the note and include or exclude suspects from the investigation.

Ransom Note Nabs Kidnapper
A 1956 kidnapping case from Long Island, New York, helps illustrate the key role forensic document examination can play in an investigation. In this case, a one-­‐month-­‐old child was taken from his home and a ransom note was

found in the baby’s carriage, supposedly left by the child’s babysitter. Investigators discovered distinguishing characteristics in the way the writer formed 16 letters of the alphabet, most notably the lowercase “m”, which resembled a sideways “z”. Investigators searched through nearly two million documents looking for similar writing until a probation officer found in his files documents written by a 31-­‐year-­‐old auto mechanic with the same peculiar “m”. Document examiners were able to conclusively match the ransom note to the suspect’s handwriting, helping to secure a conviction.
Fraudulent Checks
A common problem brought to forensic document examiners involves alterations, especially to legal documents. For instance, if someone altered a check to increase its amount, examiners may be able to determine this by comparing the way the inks from different pens react when subjected to infrared radiation. In the example below, a check made out to “Cash” for $1,000 has been altered by changing the “1” to a “9” and adding a recipient’s name. Although the black inks appear the same in visible light, when subjected to certain frequencies of infrared light, the ink used to prepare the genuine check reacts differently than the ink used to alter the check, making the alteration obvious.
Altered check written in black ballpoint pens when viewed with visible light (Courtesy of Marie Durina)

Same altered check viewed with infrared radiation (Courtesy of Marie Durina) Documents in a suspect’s possession may also reveal clues from hidden impression evidence (also known as indented writing) that could link a suspect to a crime. For instance, did the bank robbery suspect write the hold-­‐up note on top of another piece of paper that now contains impression of that text?
A notebook found with suspect’s personal effects. (Courtesy of Marie Durina)
The same notebook when analyzed with an Electrostatic Detection Device (EDD) reveals invisible impressions of the robbery demand note. (Courtesy of Marie Durina)

Examiners can also identify the materials, inks and even the type of office equipment or writing implements used to produce the document. This is especially useful in fraud cases because these details can identify the time frame in which a document was created. For instance, if analysis of the document’s paper reveals a substance that was not used in paper manufacturing during the time frame in question, the document, piece of art, or historical record would be demonstrated to be fraudulent.
How It’s Done
Evidence That May Be Examined
Questioned material may consist of identification cards, contracts, wills, titles and deeds, seals, stamps, bank checks, handwritten correspondence, machine-­‐generated documents (such as those from photocopiers, fax machines, and printers), currency and electronic documents. In some circumstances, graffiti and digital signatures may be examined; however, the client should be aware that the examination of these types of evidence can be problematic.
Documents that don’t contain visible identifiable marks may contain valuable impression evidence if they were underneath other documents when the writing was performed. Even documents that were shredded or burned may prove useful if reconstructed.
In addition, writing instruments, rubber stamps, envelopes and makes/models of office equipment in the suspect’s possession may be collected by the investigator. In digital documents, evidence could even be culled from the metadata of electronic signature files, providing information such as who the author is and when the document was written.
Collecting the Known and Unknown
When conducting examinations, forensic document examiners must have known specimens to which they compare the material in question. These samples may come from any number of known sources, such as a particular ink manufacturer or machine.
In cases involving handwriting, samples are usually divided into two types: requested writing specimens and collected writing specimens. Requested specimens are writings dictated by the investigator to the writer. These specimens are created under carefully controlled conditions, with the writer being closely monitored. Collected writing specimens, however, are writings that were completed by the subject prior to the investigation. Good

sources of writing specimens may include items such as cancelled checks, letters, diaries, signed receipts, medical records, real estate contracts, tax records or other signed legal documents.
Who Conducts the Analysis
The analysis should be performed by a qualified forensic document examiner, preferably one who is a member of a well-­‐established professional association such as the American Board of Forensic Document Examiners (ABFDE) or the American Society of Questioned Document Examiners (ASQDE). Membership requirements for these associations vary; however, an examiner typically must have completed a two-­‐year, full-­‐time training program under the guidance of a qualified forensic document examiner. To maintain membership in good standing and keep their skills current, examiners are required to complete continuing education.
How and Where the Analysis Is Performed
Forensic document examiners either work as private examiners within their own laboratory, or for publicly funded laboratories. If an agency does not have questioned documents analysis capabilities, investigators may opt to send the evidence to a nearby lab, or retain a private examiner.
The techniques and tools used in forensic document examinations leverage well-­‐established principles of physics and chemistry. A typical Questioned Documents unit in a crime laboratory is equipped with microscopes, digital imaging instrumentation, infrared and ultraviolet light sources, video analysis tools and specialized equipment including electrostatic detection devices (EDD) and materials to perform analytical chemistry.
Many forensic document examiners use only non-­‐destructive techniques that use light and/or electrostatics to examine documents for indented impression evidence or ink differentiation. However, a few examination techniques, such as liquid chromatography, are considered destructive because they require removal of small samples of ink from the questioned documents. These types of examinations may be sent off to laboratories that specialize in this type of ink analysis.
For analyses of documents created by typewriters, fax machines, or printers, examiners may rely on various databases created for comparison purposes. During handwriting analyses, examiners compare samples provided from particular populations. Certain agencies, such as the U.S. Secret Service and the German Federal Police, maintain larger databases. For example, the Forensic Information System for Handwriting (FISH) maintained by the U.S.

Secret Service Forensic Laboratory contains handwriting samples from tens of thousands of writers. Revealing text from indented impressions ― Documents that may contain indented impressions not visible to the naked eye can be visualized through the use of an Electrostatic Detection Device (EDD) such as the Electrostatic Detection Apparatus (ESDA). An EDD uses applied charges and toner to visualize areas of indented writing, making them visible to the eye. The ESDA uses the principle that indented areas of the document carry less negative charge than surrounding areas. This causes the toner used in the EDD to be attracted to these areas, revealing indentations that are present. Using this technique, indented impressions have been recovered from up to seven layers of paper beneath the original writings. Research has demonstrated that impressions can be successfully visualized from documents up to 60 years old, provided the papers are not mishandled or stored improperly. Detecting alterations, obliterations, erasures and page substitutions ― Alterations, obliterations and erasures not visible to the human eye can often be detected through use of photography and other imaging devices that utilize ultraviolet and infrared wavelengths of light. Using radiation filtered at various wavelengths, an imaging instrument such as a video spectral comparator (VSC) can reveal writing that has been added with a different ink, or has been altered or removed by exploiting variations in the way different inks respond to different wavelengths of light. For example, under certain light sources combined with an infrared filter, a document containing information written in ink that has faded over time may be enhanced or processed to appear darker and therefore more legible.
Obliterated note viewed with visible light. (Courtesy of Marie Durina)

Same note viewed with infrared radiation. (Courtesy of Marie Durina)
Determining individual dye components ― An examination called liquid chromatography can be conducted to identify the chemical composition of inks on a document. In this technique, a small cutting from the questioned document is dissolved in a solvent and analyzed. This is one of the few destructive techniques employed by the document examiner. The inks can be compared to the International Ink Library, a database maintained by the U.S. Secret Service that contains data on more than 9,500 inks that have been manufactured since 1920.
Typewritten and machine-­‐printed documents ― Documents created on a typewriter or printed with ink jet, laser printers, fax machines and photocopiers may be sourced to a particular make or model, or even to a specific machine. The printing process used to prepare documents can also be identified. When possible, the examiner should obtain known standards and any available accessories from the machine in question and the machine itself should be submitted for examination.
Seals and stamps ― Questioned documents bearing rubber stamp impressions, embossed seals, watermarks, or other mechanically printed marks may be submitted for examination. When possible, it is best to provide the examiner with any suspected devices associated with the questioned document that may have been involved in its preparation. This includes writing instrument(s), papers, or other substrates, rubber stamp(s), sealing devices (such as notary seals), printing devices or other mechanisms.
To illustrate the value of a manufacturer’s mark, consider a 1989 case when a young girl was kidnapped and murdered. Investigators called in forensic document examiners to examine the plastic garbage bag in which the victim was found. Minute markings created by the heat-­‐seal process used in manufacturing such bags enabled investigators to determine that the bag was manufactured on the same machine within seconds of other bags found in the parents’ house. This was key evidence that resulted in the conviction

of the girl’s mother for murder. (Source: WORLD OF FORENSIC SCIENCE, ©2006 Gale Cengage.)
Examination of handwriting ― When a sufficient amount of writing from two different people is closely examined, there are always identifiable differences. Comparisons of writing samples take into consideration a wide variety of handwriting characteristics including word and letter spacing, slant or slope, speed, pen position, use of capitalization, embellishments, legibility, use of punctuation, and proportion of letters and other attributes.
For example, one person may form the letter “O” in a clockwise motion, while another may form the same letter in a counter-­‐clockwise motion. A particular writer may form the letter “M” using an upward-­‐moving “arch” formation (similar to the McDonald’s Restaurant sign), while another prefers to make a “garland” form of “M”, forming this letter with a “U” motion to resemble the garland on a Christmas tree. Document examiners take into account the various combinations of features present within the writing sample as a whole. In addition, examiners look for features such as hesitations in the natural flow of writing, possible retouching or unnatural tremors. These may indicate that an unnatural writing process (e.g., simulation or disguise) has been employed.
No one writes with machine-­‐like precision every time, and variations are evident in a person’s handwriting even within the same document. For example, if a person writes an entire page of signatures, each one will vary slightly. A trained forensic document examiner can discriminate between natural variations in a writer’s own handwriting and significant differences denoting different writers.
To conduct handwriting comparisons, the investigator should obtain known writing samples that are similar in character to the document in question. If it is written in cursive, it should be compared to known cursive writing. If it contains upper-­‐ and lower-­‐case letters, the known writings must also contain upper-­‐ and lower-­‐case letters. Wherever possible, the investigator should also obtain known writing containing similar combinations of letters and numbers seen in the questioned documents. For comparison purposes, it is recommended that investigators obtain 20–30 repetitions of signatures, 15–20 repetitions of bank checks, 3–4 repetitions of entire written letters.
The investigator should also attempt to obtain known writing that is prepared around the same time period as the questioned writing. This is particularly important in cases involving writing from young people (up to mid-­‐teens), as writing formation may still be at a developmental stage, and by elderly persons, as writing may deteriorate with age or illness.
DocumentsDocumentDocument ExaminersEvidenceSpecimens