1
QUESTIONED DOCUMENTS
&COMPUTER FORENSICS
CHAPTERS 17 & 18
Unit 15
What is a Questioned Document?
2

Any object with
handwriting or print
whose source or
authenticity is in doubt
is considered a
question document.
Document Examiners…..
3




Examine handwriting to originate its
source or its authenticity.
Examine typed writings, computer
printings, photocopies, inks, papers,
forgeries, and decode altered and charred
documents.
Use microscopes, photographs,
chromatography, etc.
Many work in federal, local, and state
crime labs, but they may also work in
private practices.
In Document Examination…..
4


The gathering of documents of known authorship
or origin is critical to the outcome of the
examination.
The uniqueness of handwriting makes this type of
physical evidence one of the few definitive
individual characteristics available.
Handwriting… What do we know?
5

General Information
Two individuals cannot have
identical handwriting.
 Since handwriting is
associated with mechanical,
physical, and mental
functions, it is almost
impossible to reproduce
exactly.
 Handwriting can be almost as
individual as a person’s
fingerprint.

Handwriting…How is it done?
6

Examining and Comparing
A positive comparison must be based on a number of
common characteristics between known and
questioned writings.
 Collecting exemplars (known writings) are critical in
order to make a handwriting comparison.
 Exemplars should contain some of the same words or
combinations of letters that are present in the
questioned document(s).

12 Factors Used to Authenticate
Handwriting
7

The 12 factors examiners use to determine
handwriting authenticity:
1. Average amount of space between words and letters
 2. Relative height, width and size of letters
 Height of the uppercase and lowercase letters
 Width of letters and the space between letters and words
 Size of letters relative to the available space

12 Factors Used to Authenticate
Handwriting
8
3. Line quality – observing if the lines are smooth,
free-flowing, or shaky and wavering
 4. Connecting strokes – comparing the strokes
between upper and lower case letters, and the
strokes between the letters and the words
 5. Beginning and ending strokes – observing how
the writer begins and ends words, numbers, and
letters

12 Factors Used to Authenticate
Handwriting
9

6. Pen lifts and separations
 How
the writer stops to form new letters and begin words
 Forgeries may have lifts or separations in unusual places,
such as within a letter
7. Shading and pen pressure – the differing amounts
of pressure used by the writer that make lines light or
dark, narrow or wide
 8. Baseline habits – analyzing if the writer’s letters
stay straight or move up and down compared to a
baseline

10
12 Factors Used to Authenticate
Handwriting
9. Slant – analyzing the writing slant: left, right, or
straight
 10. Unusual letter formation – such as letters with tails
or letters written backwards, etc.
 11. Flourishes or embellishments – any fancy letters,
curls, loops, circles, etc.
 12. Letter characteristics

 Completeness
of closed characters such as o, e, and a
 Dotting of I and j, and crossing of t
10 Factors Affecting Handwriting
11

Factors that can affect handwriting samples
1. Writing instrument (pens, pencils, crayons, etc.)
 2. Writing surface (paper, wall, napkin, etc.)
 3. Underlining surface (smooth or rough)
 4. Mood of the writer (undeveloped or shaky
handwriting)
 5. Writing speed (slow or quick)

10 Factors Affecting Handwriting
12
6. Position of the writer (sitting or standing)
 7. Position of the document (flat, vertical, or
horizontal surface)
 8. Environmental exposure (temperature, humidity,
etc.)
 9. Consumption of alcohol and/ or drugs
 10. Injuries and/ or illnesses

Typescript Comparisons
13
Typescript is the result of machine-created documents,
such as computer printers, photocopiers, fax machines,
and typewriters
 Defects, missing pieces, or scratches may help to
identify the machine where the document originated

Typescript Comparisons
14
Computer printers – the kind of ink and toner
 Photocopiers – the debris patterns
 Fax machines – have a Transmitting Terminal Identifier (TTI)
 Typewriters
 Characteristics of the typeface, characters, and the
ribbon

Typescript Comparisons
15


As is true for any mechanical device, use of a
printing device will result in wear and damage to
the machine’s moving parts.
These changes will occur in a fashion that is both
random and irregular, thereby imparting
individual characteristics to the printing device.
Digital Technology
16


In the cases of photocopiers, fax
machines, and computer printers an
examiner may be called on to identify
the make and model of a machine or
to compare a questioned document
with test samples from a suspect
machine.
A side by side comparison is made
between the questioned document and
the printed exemplars to compare
markings produced by the machine.
Digital Technology
17

Examiners compare transitory defect marks, fax
machine headers, toner, toner application methods,
and mechanical and printing characteristics.
Altered Documents
18

Documents are often altered after they have been
prepared. A forgery is committed to hide the original
content of a document. Ways to alter documents:

1. Additions - Adding content to an already prepared
document.
 Infrared
luminescence
 Emits infrared light when exposed to blue-green light
 Can be used to get results if a different ink is used than
the one on the original document
Altered Documents
19

2. Erasures
One of the most common alterations.
 A rubber eraser, sandpaper, razor blade, or knife may
be scratched against the paper’s surface in an attempt
to remove writing or type.
 This irritates the top fibers of the paper which are
visible under a microscope.

Altered Documents
20

3. Obliterations
A document may have obliterations which are parts
that are blotted or smeared, making the original
unreadable.
 This is usually done with strong oxidizing agents to
make the ink become colorless.
 This is not visible to the naked eye, but can be seen
with microscopes, or ultraviolet or infrared lighting.

Altered Documents
21

Charred Documents
Sometimes documents are accidently or purposely
charred in a fire.
 Infrared photography or reflecting light at different
angles can sometimes reveal the document’s contents
after burning.

Other Document Challenges
22

Indentations
Most of the time an indented
impression is left on a paper
below the primary writing
 The best way to read the impression
is by using an ESDA (Electrostatic
Detection Apparatus)

 This
charges the paper
 Pouring toner powder over the
charged paper develops the images
on the indented paper.
Other Document Challenges
23

Paper

To identify paper, scientists may use the following
characteristics
 1.
Color
 2. Density
 3. Watermarks

 4.
Faint design made in some paper during manufacture, which is
visible when held against the light and typically identifies the
maker
Dyes or bleaches
 5. Fluorescence under UV light
 6. Raw material the paper is made from
 7. Thickness
Other Document Challenges
24

Ink

Considered a mixture, so it can be broken down into the
different chemical components using the following lab tests
1. Thin Layer Chromatography (TLC)
 2. A visible Microspectrophotometer


Studying the chemical composition can sometimes
determine
If a certain pen was used on a questioned document
 How long the ink has been on the paper

Thin Layer
Chromatography
(TLC)
Microspectrophotometer
Other Document Challenges
25

Physical/ Fracture Match of separated documents
– usually these documents are cut or torn and can
be linked to the original source.
Examples of Questioned Documents
26








1. Checks
2. Licenses and Certificates
3. Passports
4. (Counterfeit) Money
5. Receipts
6. Lottery tickets
7. Historical documents
8. Ransom and suicide
notes
Forgery
27


Forgery is an item prepared with the intent to
deceive
Types
1. Blind forgery – made without a model of the
signature or the writing being forged
 2. Simulated forgery – one made by copying a genuine
signature
 3. Traced forgery – one made by tracing a genuine
signature

Counterfeit Documents
28


A counterfeit document is one made in exact
imitation of something important or valuable with
the intention of deceit.
Columbia
The leading manufacturer of counterfeit U.S. currency
 This counterfeit production supports their growing drug
cartel

Counterfeit Documents
29

The U.S. Bureau of Engraving and Printing has
established some anti-counterfeiting security
features including
1. Watermarks
 2. Color-shifting inks
 3. Fine-line printing and microprinting
 4. Enlarged, off-center portraits
 5. Poor vision feature
 6. Denomination-specific security thread
 7. Counterfeit Detection Pen

Counterfeit Documents
30

Counterfeit detection pen – a security feature that
businesses use to help eliminate receiving
counterfeit bills.
The pen contains iodine, and when it is used on a
counterfeit bill it produces a blue-black color.
 When used on an authentic bill, it produces a pale
yellow color that fades over time.
