Overview#
A probate dispute arrives at a questioned document examiner's desk: a handwritten codicil to a will, allegedly signed by the deceased three months before death. The ink is fresh. The paper looks right. But under high-resolution microscopy, the ink sits on top of aged paper fibers rather than being absorbed into them as it would be after three months. Ink chemistry analysis confirms the writing was placed on the document no more than two weeks ago. The codicil is a forgery. Without document forensics, the fraudulent amendment might have passed undetected and a family member might have lost an inheritance.
Document Forensics combines traditional questioned document examination with advanced digital analysis to produce scientifically defensible evidence. The platform processes questioned documents through multiple specialized analysis pathways: individual pen stroke characteristics, paper fiber composition, ink chemical signatures, and printer identification markers. It serves attorneys, financial institutions, insurance companies, law enforcement agencies, and corporate security teams investigating document authenticity, forgery, alteration, and fraud.
Open Standards#
- ASTM International (Questioned Document Examination Standards): Examination protocols for handwriting analysis, signature verification, and document alteration detection align with ASTM International standards, including the nine-point reporting scale (from identification through elimination) used to communicate examiner confidence in accordance with ASTM E2290 and related questioned document examination guides.
- ISO 19005-3:2012 (PDF/A-3B): Court-ready examination reports are rendered as PDF/A-3B archival documents, embedding JSON provenance metadata alongside the human-readable report within a single ISO 19005-3 conformant package validated at generation time.
- ISO 32000-1 (PDF): The underlying PDF document model, upon which PDF/A-3 conformance is layered, is governed by ISO 32000-1; the platform honours PDF version headers, XMP metadata structures, and sRGB ICC OutputIntent requirements mandated by that specification.
- ISO/IEC 27037:2012 (Digital Evidence Handling): Collection, preservation, and presentation of questioned digital documents follow the identification, acquisition, and chain-of-custody principles defined in ISO/IEC 27037, which is actively validated in the platform's compliance layer.
- RFC 3161 (Internet X.509 PKI Time-Stamp Protocol): Export packages containing examination reports can be cryptographically bound to a trusted time source via an RFC 3161 timestamp authority receipt, proving the report existed in its current form at a specific point in time.
- FIPS 180-4 (SHA-256): Each document submitted for examination is fingerprinted with a SHA-256 digest used for deduplication, tamper detection, and chain-of-custody linkage across all custody events.
- W3C Verifiable Credentials Data Model v2.0: Chain-of-custody transfers and provenance assertions for examined document evidence are issued as W3C Verifiable Credentials, providing a tamper-evident, cryptographically signed record of each custody event.
- FRE 901 (Federal Rules of Evidence, Authentication): Report structure and integrity proof components are aligned with the authentication requirements of FRE 901, ensuring examination outputs meet the threshold for admission as evidence in US federal proceedings.
Last Reviewed: 2026-02-05 Last Updated: 2026-04-14
Key Features#
Handwriting Analysis#
Comprehensive examination of handwriting characteristics including letter formations, proportions, slant, spacing, baseline alignment, stroke sequences, pen pressure patterns, and overall writing style. The system analyses both class characteristics common to writing systems and individual characteristics unique to specific writers. Advanced optical analysis measures precise angles, ratios, and spatial relationships. Findings are reported using the standardised nine-point scale from identification through elimination, communicating confidence levels accurately.
Signature Verification#
Specialized authentication of signatures on financial instruments, legal documents, contracts, and other critical paperwork. The system distinguishes between simulated forgeries, traced forgeries, and freehand forgeries, each exhibiting characteristic indicators. Analysis examines line quality, pressure variation, rhythm, natural fluency, and dynamic flow characteristics. Temporal analysis accounts for legitimate signature evolution due to aging, medical conditions, and habit changes over time.
Ink and Paper Analysis#
Scientific examination of ink composition, paper fiber characteristics, and material properties to determine document authenticity and timeline. Ink dating analysis estimates when writing was placed on a document. Paper analysis identifies manufacturer, production batch, and age indicators. The system detects inconsistencies between purported document dates and actual material properties, revealing backdated or altered documents.
Document Alteration Detection#
Identification of additions, deletions, substitutions, and other modifications to original documents. Analysis detects overwriting, erasure, page substitution, insertion of text or signatures, and digital manipulation. The system examines ink layering, paper disturbance, printing inconsistencies, and formatting anomalies that reveal unauthorized modifications.
Digital Document Forensics#
Examination of electronically created or modified documents including metadata analysis, edit history reconstruction, font and formatting analysis, and detection of digital manipulation. The system identifies cut-and-paste operations, image manipulation, metadata inconsistencies, and hidden content within digital document files. PDF, word processing, and spreadsheet formats are all covered.
Printer and Device Identification#
Trace printed documents to specific devices through analysis of printer artifacts, toner characteristics, drum defects, and mechanical signatures unique to individual printers. Reference databases of printer characteristics allow documents to be linked to specific makes, models, and individual devices, connecting document evidence to physical locations and suspects.
Typewriter and Machine Analysis#
Identification of typewriter make, model, and individual machine through analysis of typeface characteristics, alignment patterns, and mechanical defects. Ribbon characteristics, impression depth, and spacing patterns help identify specific machines and determine whether multiple documents were produced on the same device.
Court-Ready Reporting#
Reports are structured to withstand legal scrutiny and support expert testimony. All analytical steps are documented, conclusions are tied to observable characteristics, and opinions are presented with appropriate confidence qualifications. Examination protocols align with ASTM International standards. Comparison charts illustrate specific features supporting examiner opinions for non-expert audiences.
Use Cases#
- Forgery Investigation: Examine questioned signatures and handwriting on wills, contracts, checks, and legal instruments to determine authenticity and identify the true author of fraudulent documents.
- Contract Dispute: Detect alterations, additions, or substitutions in disputed contracts through ink analysis, paper examination, and digital document forensics.
- Check Fraud: Analyse questioned checks for signature forgery, amount alteration, payee modification, and counterfeit detection.
- Threatening Communications: Identify authors of anonymous threatening letters through handwriting analysis, printer identification, and paper sourcing.
- Insurance Fraud: Examine suspicious claims documentation for backdating, alteration, and fabrication.
- Estate Litigation: Authenticate signatures on wills and estate documents, considering diminished capacity indicators and evidence of physical guidance.
Integration#
Connects with evidence management systems, case management platforms, and forensic laboratory information systems. Examination results flow into investigative workflows and can be packaged for court presentation. The module integrates with other forensic disciplines including behavioural profiling, timeline reconstruction, and cyber forensics for comprehensive investigations.