What is Forensic Document Examination?

Forensic Document Examination is the scientific examination and comparison of documents to determine questions such as:

• Is a document genuine or fabricated?
• Has a document been altered?
• Was a signature written by a particular person?
• Was text added, removed or replaced?
• What printing technology produced the document?
• Can erased or obscured writing be recovered?
• Are two documents associated with the same source?
• Can the sequence of entries or alterations be determined?
• Can a damaged or partially illegible document be made more readable?

A forensic document examiner may therefore examine handwriting, signatures, paper, ink, printing, alterations, indentations, stamps and other physical characteristics.

 Why the Digital Age Has Changed Document Forensics

Earlier, a "document" usually meant a physical object:

Paper → Ink → Handwriting → Signature → Stamp

Today, a document may follow a much more complicated pathway:

Digital creation → Editing → Conversion → Printing → Scanning → PDF → Cloud storage → Electronic transmission

This creates new forensic questions.

For example:

Was the PDF created from an original document or modified after scanning?

Was a signature handwritten, digitally inserted or electronically generated?

Was text altered after the document was created?

Do the metadata and visible content agree?

Does a scanned document contain evidence of manipulation?

The examiner therefore may need to combine questioned-document examination + image analysis + metadata examination + digital forensic principles.

Traditional vs Digital Document Examination

The important point is that digital document examination does not replace traditional FDE. Both can be required in the same investigation.

Major Areas of Forensic Document Examination

A. Handwriting Examination

Handwriting remains an important area of FDE.

Examiners compare questioned writing with known samples by examining features such as:

• Letter formation
• Slant
• Baseline characteristics
• Letter size
• Spacing
• Proportions
• Pen lifts
• Connecting strokes
• Initial and terminal strokes
• Writing movement
• Line quality
• Relative positioning
• Natural variation

Importantly, handwriting examination is not simply about whether two samples "look similar." Examiners consider how the writing was executed. For example, hesitation, unusual pen lifts or changes in stroke movement may be relevant when examining a suspected simulation or forgery.

Important principle: Natural variation

A person's handwriting is not perfectly identical every time.

Therefore, an examiner needs sufficient known specimens to understand the person's normal variation. NIST specifically emphasizes comparing appropriate writing types and using multiple known samples where possible.

Signature Examination

Signature forgery is one of the classic problems in forensic document examination.

Common forms include:

1. Simple imitation

The forger attempts to reproduce the appearance of the genuine signature.

2. Freehand simulation

The forger practices the signature and reproduces it without tracing.

3. Tracing

The genuine signature is used as a model and traced.

4. Digital signature-image manipulation

A scanned or photographed signature may be copied and inserted into another document.

5. Cut-and-paste manipulation

A genuine signature may be extracted from one digital document and placed into another.

A forensic examiner looks beyond superficial appearance. Features such as stroke quality, pen movement, hesitation, pen lifts and execution characteristics may be significant.

Examination of Altered Documents

Document alteration can involve:

• Addition of text
• Deletion
• Erasure
• Overwriting
• Substitution
• Modification of numbers
• Page replacement
• Addition of signatures
• Changes in dates
• Modification of amounts
• Removal of information

For example:

₹10,000 → ₹90,000

or

01/08/2026 → 01/09/2026

Even apparently simple modifications may leave physical or digital clues.

SWGDOC/ASB standards identify features such as inconsistent handwriting, irregular spacing, different printing processes, unusual alignment, discoloration, smearing and differences in paper characteristics as potentially relevant during altered-document examination

Ink Examination

Ink can provide valuable evidence.

Different inks can have different:

• Chemical compositions
• Dyes
• Pigments
• Solvents
• Optical characteristics
• Fluorescence/absorption properties

Examiners may use techniques such as:

• Microscopy
• UV examination
• Infrared examination
• Thin-layer chromatography (TLC)
• Spectroscopic techniques
• Other instrumental methods

One particularly useful principle is that inks that appear identical under ordinary illumination may behave differently under other wavelengths. NIST describes the use of different lighting conditions, including infrared, to reveal distinctions that may not be visible in normal light.

SWGDOC also publishes standards covering writing-ink comparison, ink identification and nondestructive examination of paper.

Paper Examination

Paper itself can become evidence.

An examiner may investigate:

• Paper thickness
• Texture
• Colour
• Fibres
• Watermarks
• Fluorescence
• Manufacturing characteristics
• Surface coatings
• Damage
• Physical matches

Suppose a suspect document is claimed to have been produced in 2018, but the paper or printing characteristics indicate something inconsistent with that claim. The physical document may therefore provide information relevant to the investigation.

Indented Writing Examination

When someone writes on a sheet of paper, pressure from the pen can sometimes leave impressions on sheets underneath.

These impressions are known as indented writing.

The original writing may have disappeared, while impressions remain.

A forensic examiner may use appropriate lighting or specialized techniques to visualize these impressions. Modern standards specifically address examination of document indentations.

Printing Process Examination

Modern documents can be produced by:

• Laser printers
• Inkjet printers
• Photocopiers
• Multifunction printers
• Digital presses
• Typewriters
• Other mechanical or electronic printing systems

The examiner may investigate:

• Toner characteristics
• Inkjet characteristics
• Printing defects
• Alignment
• Repeating patterns
• Printer-specific characteristics
• Differences between printing processes

SWGDOC standards specifically include examinations of documents produced using toner technology and liquid inkjet technology

Digital Documents: A New Forensic Challenge

A digital document can contain much more information than what appears on the screen.

For example, a PDF or office document may potentially contain information concerning:

• File creation
• Modification
• Software used
• Author information
• Embedded objects
• Revision information
• Fonts
• Images
• Digital signatures
• File structure
• Timestamps
• Document properties

However, metadata should not automatically be treated as proof of who created or modified a document. Metadata can be altered, stripped during conversion, or generated by software rather than directly representing the human action investigators are interested in.

This is where forensic interpretation becomes important.

Metadata Examination

Consider a suspicious PDF:

Visible document:
Contract dated 15 January 2025

Potential forensic questions:

• When was the file created?
• When was it modified?
• What software generated it?
• Was it converted from another format?
• Are there embedded images?
• Are there multiple versions?
• Does the metadata conflict with the claimed history?

The examiner should preserve the original file and document every examination step because digital evidence can be altered through improper handling.

Digital Signature vs Scanned Signature

This distinction is extremely important.

Scanned signature

A person's handwritten signature is:

Written → Photographed/scanned → Converted into image → Inserted into document

The result is essentially an image.

Digital signature

A cryptographic mechanism is used to authenticate a digital document and detect certain unauthorized modifications.

Therefore:

Image of signature ≠ cryptographic digital signature

A forensic examiner must establish exactly what type of "signature" is being presented.

PDF Forensics

PDF files are particularly important in modern document investigations.

Investigators may examine:

• PDF metadata
• Embedded fonts
• Embedded images
• Object structure
• Incremental updates
• Digital signatures
• Annotations
• Form fields
• Attachments
• Text layers
• Image layers
• File timestamps
• Document revisions

A visually identical document can sometimes have a very different underlying structure.

For example:

PDF A

Scan → OCR → edited → exported PDF

versus

PDF B

Original digital document → exported PDF

The two documents may look identical but have different forensic characteristics.

Image Forensics and Document Examination

Many modern documents reach investigators as:

• JPEG photographs
• Screenshots
• Scanned PDFs
• WhatsApp images
• Email attachments
• Cloud documents
• Social-media uploads

Image analysis may help investigate:

• Cropping
• Resizing
• Compression
• Copy-paste manipulation
• Inconsistent resolution
• Different image regions
• Text insertion
• Digital retouching

However, image-forensic conclusions must be carefully framed because common operations such as messaging-app compression and scanning can themselves change image characteristics.

OCR and Forensic Documents

OCR — Optical Character Recognition converts an image of text into machine-readable characters.

Forensic applications include:

• Converting scanned documents into searchable text
• Recovering information from large document collections
• Comparing text
• Locating names or numbers
• Supporting examination of historical documents

But OCR can introduce errors.

For example:

Original: 1,00,000

OCR: I,00,000

Therefore, OCR output should not automatically be treated as identical to the original visual document.

AI in Forensic Document Examination

Artificial intelligence is increasingly relevant to document examination.

Potential applications include:

Handwriting recognition

Machine-learning models can compare handwriting features.

Signature verification

AI can assist in detecting similarities and anomalies.

Document classification

AI can categorize large volumes of documents.

Forgery detection

Algorithms may identify suspicious visual inconsistencies.

Image manipulation detection

AI-based systems can assist in identifying manipulated images.

OCR enhancement

AI can improve recognition of degraded or difficult-to-read documents.

NIST describes research into automatic handwriting-matching algorithms designed to provide objective and reproducible scores, illustrating the growing intersection between handwriting examination and computational methods.

But Can AI Replace a Forensic Document Examiner?

No—not by itself.

AI can be an analytical aid, but forensic conclusions require:

• Appropriate evidence
• Valid methodology
• Quality control
• Understanding of limitations
• Human interpretation
• Proper documentation
• Independent verification where appropriate

There is also a risk of algorithmic bias.

NIST's work on handwriting examination emphasizes human factors, error reduction and the need for rigorous approaches to forensic interpretation.

Digital Alteration vs Physical Alteration

Modern cases can involve both simultaneously.

For example:

A fraudster modifies a digital contract → prints it → signs it → scans it → converts it to PDF → sends it by email.

This creates a hybrid forensic problem.

Chain of Custody in Digital Document Examination

Chain of custody remains fundamental.

The examiner should establish:

Collection → Identification → Preservation → Examination → Documentation → Reporting → Presentation

For digital documents, investigators should be particularly careful about:

• Original file preservation
• Hash values where appropriate
• Acquisition procedures
• Storage
• Access logs
• Working copies
• Examination tools
• Examiner actions
• Reporting

Digital evidence can be altered, damaged or destroyed through improper handling, so preservation and documentation are essential.

A Typical Forensic Document Examination Workflow

Step 1 — Evidence collection

Obtain the questioned document and relevant known samples.

Step 2 — Documentation

Photograph or digitally preserve the evidence before examination.

Step 3 — Preliminary examination

Record visible characteristics without unnecessarily altering the evidence.

Step 4 — Non-destructive examination

Use appropriate:

• Magnification
• Lighting
• UV
• IR
• Imaging
• Measurements

Standards for altered documents specifically describe microscopic/macroscopic examination and different lighting techniques as part of non-destructive examination.

Step 5 — Comparative examination

Compare questioned material with suitable known material.

Step 6 — Instrumental examination

If necessary, use analytical techniques such as spectroscopy or chromatography.

Step 7 — Digital examination

For electronic documents, examine appropriate file properties, structure, metadata and related digital evidence.

Step 8 — Interpretation

Assess observations using an appropriate scientific framework.

Step 9 — Report

Document methods, observations, limitations and conclusions.

Step 10 — Court presentation

The examiner may explain findings and limitations as an expert witness.

Equipment Used in Modern Document Examination

A modern forensic document laboratory may use:

Traditional equipment

• Hand magnifiers
• Stereo microscope
• Comparison microscope
• Measuring instruments
• UV light sources
• IR imaging systems
• ESDA/indentation examination equipment

Chemical/instrumental equipment

• TLC systems
• Raman spectroscopy
• FTIR
• Microspectrophotometry
• Other analytical instruments

Digital equipment

• High-resolution scanners
• Digital microscopes
• Image-analysis software
• Metadata-analysis tools
• PDF/document-analysis tools
• Forensic workstations
• File-hashing and evidence-preservation tools

Applications in Criminal Investigation

Forensic document examination can assist investigations involving:

Financial fraud

• Forged cheques
• Altered bank documents
• Fake receipts
• Loan documents

Identity fraud

• Fake identity documents
• Forged signatures
• Modified certificates

Property disputes

• Altered agreements
• Forged wills
• Manipulated deeds

Academic fraud

• Fake certificates
• Altered marksheets
• Forged degrees

Corporate fraud

• Modified contracts
• Unauthorized documents
• Fake approvals

Criminal cases

• Threatening letters
• Suicide notes
• Ransom notes
• Forged evidence

A Hypothetical Investigation

Imagine investigators receive a suspicious property agreement.

The accused claims:

"The document is original and was signed in 2024."

The forensic team might examine:

Physical document

→ Paper characteristics
→ Ink differences
→ Signature characteristics
→ Printing method
→ Erasures
→ Indented writing
→ Alterations

Digital copy

→ File metadata
→ PDF structure
→ Embedded images
→ Creation/modification information
→ Digital signature information
→ Possible image manipulation

The examiner can then integrate the findings rather than relying on a single characteristic.

Future of Forensic Document Examination

The future is likely to be hybrid rather than purely digital.

We can expect increasing integration of:

Traditional FDE + Digital Forensics + AI + Imaging + Chemistry + Cybersecurity

Emerging areas include:

• AI-assisted handwriting comparison
• Automated signature analysis
• Deepfake document detection
• AI-generated document identification
• Advanced ink analysis
• Hyperspectral document imaging
• 3D document analysis
• Automated alteration detection
• Digital provenance analysis
• Blockchain-based document verification
• Advanced PDF forensics
• Multimodal forensic examination

The field is therefore moving from simply asking "Who wrote this?" to broader questions such as:

Who created the document, how was it created, when was it modified, what technologies were involved, and can its claimed history be scientifically supported?

Follow cyberdeepakyadav.com on

 Facebook, Twitter, LinkedIn, Instagram, and YouTube