Forensic Document Examination

Practical Applications in Forensic Science 141 Forensic Document Examination What is Forensic Document Examination? Forensic Document Examination (FDE) is a forensic science discipline in which expert examiners evaluate documents disputed in the legal system. Documents may be defined broadly as being any material bearing marks, signs or symbols intended to convey a message or meaning to someone. Questioned document examinations involve a comparison of the document, or aspects of the document, to a set of known standards (i.e., authentic specimens). The goal of the forensic document examiner is to systematically evaluate the attributes and characteristics of a document in order to reveal how it was prepared or how it may have been modified. Training and Qualifications of a Forensic Document Examiner There are two internationally recognized programs that accredit forensic laboratories: The American Society of Crime Laboratory Directors Laboratory Accreditation Board and ASI-ASQ National Accreditation Board/FQS. These accrediting programs ensure that forensic laboratories meet established quality standards, and employ expert forensic investigators. Forensic document examinations should be conducted by a Forensic Document Examiner (FDE or Document Examiner ). Currently, no federal licensing exists for forensic document examiners; however, in the United States, the American Board of Forensic Document Examiners (ABFDE) has established guidelines and issues a certificate of qualification. The ABFDE requires that examiners obtain a minimum of a baccalaureate degree and complete

142 Mark Songer a two-year, full-time training program or apprenticeship in a recognized forensic laboratory or with an established examiner in private practice. The National Association of Document Examiners (NADE) also was established in 1979 to promote the interests of document examiners. Peer group testing is also available through the American Society of Forensic Document Examiners (ABFDE) and the Forensic Science Society (FSS). Although there are no specific college majors or degrees in forensic examination, scientific training is encouraged and continuing education courses are required to remain in good standing with the aforementioned boards. Standards of Practice The American Society for Testing and Materials (ASTM) publishes standards for methods and procedures used by Forensic Document Examiners. ASTM International is a global leader in the development and delivery of voluntary consensus standards, to improve product quality, enhance health and safety, strengthen market access and trade, and build consumer confidence. With respect to forensic standards, ASTM describes four components to Forensic Document Examination, indicating that an examiner makes scientific examinations, comparisons, and analyses of documents in order to: 1. Establish genuineness or non-genuineness, or to expose forgery, or to reveal alterations, additions or deletions, 2. Identify or eliminate persons as the source of handwriting, 3. Identify or eliminate the source of typewriting or other impression, marks, or relative evidence, and 4. Write reports or give testimony, when needed, to aid the users of the examiner s services in understanding the examiner s findings. The Scientific Working Group for Forensic Document Examination (SWGFDE) is another organization that develops standards in the field of forensic document examination. SWGDOC began in 1997, and is composed of private examiners and forensic laboratories throughout the United States. ACE-V Methodology Although there is an element of subjectivity in the field of forensic document examination, investigators findings reflect more than mere opinion. Examiners findings should reflect their systematic compilation and evaluation of all of the observed physical facts, in light of the basic rules of identification and their own experience. The ACE-V methodology is one such way of organizing and evaluating data for the purposes of scientific classification and comparison.

Practical Applications in Forensic Science 143 ACE-V is an acronym for an established forensic methodology analogous to the scientific method, which is used to individualize or exclude impressions or objects as having originated from an identical source or as being on in the same. 1 A stands for analysis, or the process in which gathered information is analyzed for specificity and relevance; C represents the comparison stage, or the stage in which it is determined whether the examiner s predictions are valid, invalid, or inconclusive; and E stands for evaluation, which relies on the examiner s training and experience to evaluate the information generated in the analysis and comparison stages of the ACE-V method. The last stage in the ACE-V methodology is verification, wherein a second expert document examiner retests the original hypothesis using the ACE process in order to determine whether it is possible to formally individualize or exclude particular information sets used for comparison. Handwriting Examination and Comparison The examination of handwriting and signatures involves the comparison of writing on the document in question to additional samples in order to determine potential authorship. The primary premise of handwriting identification is that no two people write exactly alike, although natural variations occur within the handwriting of each individual. Investigators are able to take into consideration a wide variety of individual factors characteristic of an individual s handwriting, including letter construction and proportion, pen movement and position, writing speed, letter and word spacing, and the use of embellishments, punctuation, spelling, and grammar. It should be noted that handwriting identification or examination is distinct from handwriting analysis (graphology), which attempts to predict character traits from handwriting examination. The latter has yet to demonstrate valid and reliable results, whereas research has demonstrated that expert forensic document examiners are significantly more able to accurately compare handwriting samples to determine authorship, as compared to the layperson. Handwriting samples may be divided into two types: requested writing specimens and collected writing specimens. Requested writing specimens are gathered from the writer under carefully controlled, monitored conditions, whereas collected writing specimens were completed by the writer prior to the investigation in the normal course of their daily activities. It is critical that the document examiner obtain multiple samples of an individual s handwriting for comparison to any questioned document, as natural variations will always be present in a person s handwriting, even within the same document. Individuals also willdisplay minor variation in their signatures across documents, so forensic standards indicate that investigators obtain 20-30 repetitions of signatures, 15-20 repetitions of bank 1 Craig Coppock, Universal Definition of ACE-V Updated, 6-19-2012

144 Mark Songer checks, and 3-4 repetitions of entire written documents for comparison purposes. When comparing handwriting from collected specimens, however, it is important to collect contemporaneous writing, or material that was written around the same time period as the document in question. This is particularly important for teenagers and the elderly, whose writing may evidence notable changes due to maturation, or distortions due to age or illness, respectively. Signatures Forensic examiners are often required to evaluate the authenticity of an individual s signature, particularly in the case of contested wills or other legal documents. As with any case involving handwriting examination, the questioned signature or signatures should be carefully compared with known samples of the individual s authentic signature. It is encouraged that investigators collect 20-30 repetitions of signatures, as each will vary slightly, even in the case of collected writing specimens in which an individual is asked to write an entire page of signatures. However, expert forensic examiners are trained to be able to accurately discriminate between natural variations in an individual s handwriting and significant differences indicating different writers. Disguised Handwriting Disguised writing is distorted writing that is intended to mislead the reader or forensic examiner as to authorship, and is often present in questioned documents. Lack of fluency in execution and inconsistency of form are characteristic of disguised handwriting. For example, forensic examiners may be alerted to the possibility of attempts to disguise writing if the pen strokes stop at inappropriate locations or there is evidence of a tremor. Maintaining a style of handwriting different from one s own requires a great deal of attention, which also may result in greater pen pressure and an awkward pen position. Typical strategies employed when someone is attempting to disguise their handwriting include changing the slope of the writing or lengthening the terminal strokes and adding curves or other embellishments. Frequently, writers attempting to disguise their handwriting will change from all uppercase to all lowercase. Writers may also write with their unaccustomed hand in order to disguise their handwriting, which usually results in a drastic reduction in skill level characterized by a loss of fluency and larger letters than when written with their dominant hand. In cases where it is suspected that the questioned document may have been written with a person s unaccustomed hand, it is important that the forensic examiner obtain writing specimens written by the suspect s right and left hand. It is important to note, however, that not all distortions in handwriting are the result of intentional disguise. Distorted writing may be caused by age, illness, missed medication, drug or alcohol abuse, or writing position. Thus, it is important

Practical Applications in Forensic Science 145 that obtained writing specimens be taken from around the time of the questioned document. Simulated Writings and Tracing Simulated writing occurs when an individual attempts to copy the handwriting of another by making a freehanded drawing of the writing or by tracing authentic writing. Both handwriting and signatures can be simulated or traced; however, the latter is more common. An individual attempting free-handed simulation of writing strives for both accuracy of shape and proportion, and fluency of line; however, it is nearly impossible to achieve both. In general, people vary in their ability to produce an effective freehand drawing of writing or a signature. Signatures may be of particularly poor quality if they must be reproduced in front of the person intended to receive or verify it (e.g., signing a credit card receipt in front of a storekeeper). In natural writing, the writer is likely to have a strong fluency of line- meaning the pen will rarely, if ever, leave the paper while writing a single word or signature. In simulated writing, however, the pen may be lifted more frequently from the page, as it is easier to achieve an accurate shape and proportion with a shorter line. Thus, forensic document examiners may use magnification, usually 20-40X, to better identify pen lifts and breaks, which is more often found in simulated writing, as compared to natural writing. Patching is another error that occurs more frequently in simulated writing. Patching occurs when the writer notices an error made in their writing, such as not fully closing a letter or omitting an embellishment characteristic of the original, and corrects these errors after writing the letter or word. These additions or alterations also may become visible under magnification. Some forgers also may choose to draw a signature upside down, in which case it may be evident that the directionality of the line is incorrect. Tracing a signature or handwriting can be achieved through a number of means, assuming the individual has access to an authentic sample of writing. Tracing paper may be placed over the genuine writing or a light box may be used to illuminate the underlying writing so that the overlying paper may be traced upon. Another way to trace writing is to place carbon paper on top of the original document so that the pressure of the pen will produce a carbon impression upon the lower document. It is also possible to place the original on the document where the writing is required and to trace heavily so that impressions are left on the document beneath, which are then inked. As compared to a freehand copy, tracing a signature often results in a very close approximation of the original; in fact, they may provide a more exact copy of a signature than would normally be found due to natural variations in handwriting. However, there will likely be evidence of laborious production, such as signs of uneven pen pressure, pen lifts, and poor line quality.

146 Mark Songer Paper Examinations Questioned document examiners frequently are called upon to analyze a single sheet or multiple sheets of paper upon which there are markings, handwriting, printing, and/or graphics. Preliminary investigations of questioned paper documents involve testing the color, thickness, weight, weave pattern, and fiber analysis in order to determine the source of the paper. Further testing may involve the examination of ultraviolet characteristics and comparisons using instrumental analyses. The color of a piece or pieces of paper may be compared against a white standard or through a side-by-side comparison. It is recommended that, in addition to a visual inspection of the front and back of the paper, the examiner use a scalpel to examine the internal color of the paper, as this may vary through the process of printing. Thickness may be measured by using paper calipers or micrometers, while weight may be measured by using a very sensitive scale. Forensic examiners also evaluate paper documents for internal or surface weaves. Surface weaves are uncommon but are easily visualized with side lighting. Internal weaves are more commonly found in paper and can be viewed with transmitted light. Finally, paper fiber analysis is a destructive technique that allows examiners to identify the type and quantity of fibers involved as a result of the pulping process. For paper produced with wood fibers, a very small piece of the questioned document may be cut away and disintegrated in water. For cotton fiber-based paper, it may be necessary to use a weak acidic solution to disintegrate the paper into its individual fibers. Watermarks also may be useful to examiners as a means of identifying the type of paper, manufacturer, and date of production. Watermarks are frequently visualized simply by using transmitted light or soft x-rays, which produces an image of the density of fibers.

Writing and Printing Inks Practical Applications in Forensic Science 147 Non-destructive examinations, such as visual, microscopic, ultraviolet, and infrared tests are usually the first step taken in an effort to identify the class of ink used on a document. Further destructive testing may also be necessary to discriminate among ink types. Liquid chromatography may be conducted in order to determine the chemical composition of inks used in a document. As one of the few destructive techniques employed by forensic investigators, a small piece of the document containing the ink is cut away, dissolved in solvent and analyzed. The ink s composition can then be compared to the International Ink Library, a database of more than 9,500 inks that is maintained by the U.S. Secret Service. Chemical tests are important in the examination of printing inks because they also allow examiners to provide an approximation of when the document was written. This may be particularly salient in the case of forgeries; for example, it may be discovered that the ink on a document is much too new for its purported age. Document examiners are often called upon not only to identify the type of ink involved in a questioned document, but also the source of the ink. Determining the origin of the ink on a document may be especially useful in helping examiners to detect fraudulent entries or alterations in a document. For example, a fraudulent entry in a will may be added with ink that is visually similar but chemically different from that of the rest of the document, indicating that it was not included at the time of its original writing. While differentiation among inks can be accomplished by visual examination, nondestructive, and chemical tests, positive identification of the specific source of the ink (i.e., the exact pen) is unlikely. More probably, the examiner will be able to trace the ink back to the specific type, class, and or brand of ink, and suggest that it is scientifically indistinguishable from the suspected source. Infrared or ultraviolet examination also may allow the examiner to differentiate between different types of ink.

148 Mark Songer Altered check viewed under visible light and infrared radiation. (Image courtesy of Marie Durina) Typewritten and Machine-Printed Documents Typewritten, printed, faxed, and photocopied documents are vulnerable to text alteration and augmentation, page substitution, and cut and paste manipulation. The relatively poor quality of faxes and photocopies, in comparison to the original document, means that they may be particularly susceptible to manipulations or alterations for fraudulent purposes. Although structural characteristics are often still evident, subtle details, such as hesitations, pen lifting, and retouching may not be reproduced. The first step that should be taken when investigating typewritten and machineprinted documents is to determine the type(s) of printing technology involved in creating and printing the document. Next, it should be established whether the questioned document is an original or a reproduction, and whether there were multiple printing methods involved in the creation of the document (e.g., a printed document that was then photocopied and/or faxed). Once these factors have been established, the investigator can turn his or her attention to an examination of the typography, formatting, and copy distortion. Adobe Photoshop or similar software may be used to assess line orientation and spacing, which may be particularly useful in helping to identify anomalies or distortions in the text. Whenever typewritten or machine-produced documents are called into question, each page of the document should be carefully compared to all of the other pages of the document, and, whenever possible, compared to collected specimens from the source machine(s). Typewriters Although typewriters have largely fallen into disfavor with the advent of the computer age, forensic document examiners still may be called upon to investigate documents written on a typewriter. Any examination involving typewriting should include an evaluation of the class of typewriter, horizontal spacing, typestyle and make and model, and individual characteristics and defects.

Practical Applications in Forensic Science 149 Typewritten documents may be traced back to the typewriter on which they were written by means of the class characteristics of the machine (e.g., manual/ electric, fabric ribbon/carbon film ribbon, type design) and individual variations across machines due to wear and tear, damage or misuse. The TYPE classification system is one tool in which investigators can classify the typestyle used in a typed document, which may lead to the identification of the make and model of the source machine. Whenever possible, the forensic investigator should examine the particular machine(s) suspected to have been used in creating questioned documents in order to compare individual characteristics. Facsimile and Photocopy Machines Questioned document examinations involving facsimile (fax) machines often include questions around the authenticity of a reproduced signature, concerns around whether information has been altered, added, or deleted from a document, or questions about exactly when a fax was transmitted. Transmitted faxes are often printed at a relatively low resolution, compared to documents that are printed or photocopied. As a result, subtle details often relied upon in the analysis of handwriting or typed writing may not be reproduced. Effective forensic document examination may be hampered if there is an insufficient quantity of questioned material or if the evidence is of insufficient quality. Research has also found that faxes may undergo significant dimensional changes that can result in changes in size or even distortion, further complicating the investigation of transmitted questioned documents. Given the poor quality of faxes in general, they are subject to alteration, however, so careful scrutiny should be applied to any discrepancies in pixilation across the document, as well as any variations in handwriting or print type, spelling, punctuation or formatting. Any forensic document examination involving a fax machine also should include consideration of the Transmit Terminal Identifier (TTI), which is typically found in the heading of any transmitted document. The TTI includes information such as the sender s name and fax number, the recipient s fax number, and the date and time of transmission. This information may be invaluable to the investigator as a means of identifying the make and model of the source machine and recipient machine, and the date of transmission. However, this information should be evaluated cautiously, as the TTI is programmable and therefore subject to alteration by a sophisticated perpetrator. Some fax machines also allow the user to reprogram certain formatting characteristics, which may make it more difficult to accurately discern the make and model of the source machine. Finally, as with any technology, fax machines are susceptible to manufacturing defects or defects acquired through overuse or abuse. These defects may occur in the source machine, the recipient machine, or both, and must be differentiated from the noise that may occur during transmission. Therefore, when faxed documents are

150 Mark Songer called into question, both the source and receiving fax machines should be entered as evidence, as well as sample faxes from both fax machines transmitted around the date established by the TTI. Computers and Printers The increasingly ubiquitous use of computers resulting in computer-generated documents has resulted in difficulties for the questioned document examiner. Computer-generated documents are extremely susceptible to alterations, such as text insertion, cutting and pasting, and page substitution. Therefore, questioned document examiners must consider the consistency of the overall document in order to look for signs of tampering. For example, the examiner must determine whether multiple printers or other technologies were used in composing the document, in addition to investigating any other potential anomalies. When page substitution is suspected, the date of writing or printing also should be evaluated, as chronological inconsistencies can be useful in discrediting questioned documents. When faced with a computer-generated document, the investigator first attempts to classify the printing process by identifying the printing technology. For example, the examiner determines whether the document was printed in color or black-and-white ink, whether the document was printed with ink or toner, and whether the printing process was impact or non-impact. Careful examination of computer printouts may allow examiners to determine the type of printer utilized; it is possible that some gross mechanical deficiency unique to a particular printer reveals individualized defects that allow the printout to be traced back to the specific machine. However, in comparison to typewriters, it is rarely possible to link the questioned document back to the specific computer on which it was written. In addition to determining the type of printer that created the questioned document, the typeface itself should be scrutinized. Font and line spacing should be examined, as discrepancies may be subtle but indicative of an alteration or addition to the original document. As with any questioned document, the forensic examiner also will examine the printout to determine the type of paper and class of ink utilized, as well as taking careful note of watermarks, and staple hole patterns etc. These identifying characteristics do not always offer definitive proof that a document has been altered or tampered with, but in some cases may show conclusively that a document is not authentic. For example, it may be the case that a page is substituted in a will that is printed on paper or with ink that was not available at the time of the original signing. Seals and Stamps Questioned documents may include markings from rubber stamps, embossed seals, watermarks, or other mechanically-printed marks. Stamp classification is based on the location of the ink source rather than the type of die material and there are four

Practical Applications in Forensic Science 151 main classifications of conventional stamps: the pre-inked stamp, the flat-die stamp, the hand stamp, and the self-inking stamp. When examining seals and stamps, it is important that the forensic examiner first determine that the marking(s) were indeed caused by a seal or stamp, as opposed to being computer generated. Once this is accomplished, the examiner may turn his or her attention to the specific nature of the markings, specifically noting any defects that may be unique to an individual stamp. These may be manufacturing defects, such as defective die material, distortion, or misalignment, or may be a result of use (e.g., accumulated ink, dirt, or fibers) or misuse. The preliminary visual inspection of a stamp impression is to examine it microscopically, during which time the examiner may be able to identify a number of factors, including the ink source and condition of the ink die. Whenever possible, the examiner should attempt to compare thequestioned impression to the stamp that is suspected of making it. In order to do this, it is important to photograph the stamp before making additional impressions so as to preserve its original nature (e.g., ink saturation, dirt, fibers). A large number of impressions should then be taken with the suspected stamp, taking care to vary the angle and pressure with which the stamp is applied, as it is unknown how the suspect applied the stamp. A side-by-side comparison can then be conducted with the questioned impression, and conclusions as to the source of the impression may be made. Indented Impressions Indented impressions occur when an imprint is left on the paper(s) underlying the one that was forcibly written or marked upon. Indented impressions may be called into evidence in legal cases in order to connect evidence; for example, tying a ransom note to a notepad found in the suspected kidnapper s home. Documents that contain indented impressions not visible to the naked eye may be recovered through the use of an Electrostatic Detection Device (EDD) and oblique lighting photography. The most commonly used EDD is the electrostatic detection apparatus (ESDA), which uses an electrostatic charge and toner to visualize areas of indented writing that may have been left by erasures or pressure from writing on top of the document in question. This technique has resulted in the recovery of indented impressions on paper up to seven layers beneath the original writing, though findings may vary depending on pen pressure and paper thickness. Obliterations and Alterations Forensic document examiners are often called upon to determine whether questioned documents have been augmented or altered for fraudulent purposes. Documents may be altered by erasing or obscuring writing, or by changing, extending, or adding text or signatures. Erasures are often easily detected by visual examination, and even writing erased through a chemical solvent may leave stains that are visible under

152 Mark Songer infrared (IR) light or luminescence, UV radiation, or oblique lighting. They may also result in roughened or disturbed paper fibers and impressions of the original writing, and ink written over erased areas tends to bleed slightly and spread. Obliterations or overwriting the blocking out of portions of writing using some opaque material also may be used to obscure writing or other information on the questioned document. Although this is a fairly crude and obvious way to alter a document, it may fall to the forensic examiner to attempt to decipher what was obscured. It is sometimes possible to remove the obliterating material using an ordinary rubber eraser, chemical solvent or scraping off the overlying layer, although pains must be taken not to damage the underlying writing. The use of an IR imaging system may be useful in helping examiners to differentiate the original writing from the covering material as well. Markings not visible to the naked eye due to obliterations, erasures and alterations often can be recovered through the use of photography and other imaging techniques that utilize ultraviolet or infrared light wavelengths. For example, an infrared light filter, combined with other light sources, causes ink that has faded over the years to be enhanced and therefore legible. Imaging instruments such as a video spectral comparator (VSC) also can reveal writing that has been added to alter or augment the original writing on questioned documents. Adding new information that was not in the original document or substituting an entire page also may perpetrate fraud. This can be done with vary degrees of sophistication and success. It may be obvious that a line was inserted, for example, if it is crudely written in the margins or between lines of text. However, more sophisticated insertions or alterations require careful examination of the document as a whole to identify discrepancies. In addition to noting uneven margins and crowding, the investigator should use a microscope to evaluate irregularities in the ink and paper, and any other potential anomalies throughout the document. Obliterated writing viewed under visible light and infrared radiation. (Image courtesy of Marie Durina)

Conclusion Practical Applications in Forensic Science 153 Questioned document examination is a forensic science discipline in which documents called into question in the legal system are evaluated by a trained examiner. Trained forensic document examiners systematically inspect questioned documents and compare aspects of the document to known standards in order to identify the nature and source of the writing or printing. This process typically culminates in the presentation of gathered evidence at preliminary hearings, pretrial depositions, or in a courtroom.