QUESTIONED DOCUMENTS &COMPUTER FORENSICS CHAPTERS 17 & 18

Unit 15

1

What is a Questioned Document?

Any object with handwriting or print whose source or authenticity is in doubt is considered a question document.

2

Document Examiners…..

Examine handwriting to originate its source or its authenticity.

Examine typed writings, computer printings, photocopies, inks, papers, forgeries, and decode altered and charred documents.

Use microscopes, photographs, chromatography, etc.

Many work in federal, local, and state crime labs, but they may also work in private practices.

3

In Document Examination…..

The gathering of documents of known authorship or origin is critical to the outcome of the examination.

The uniqueness of handwriting makes this type of physical evidence one of the few definitive individual characteristics available.

4

Handwriting… What do we know?

General Information Two individuals cannot have

identical handwriting. Since handwriting is

associated with mechanical, physical, and mentalfunctions, it is almost impossible to reproduce exactly.

Handwriting can be almost as individual as a person’s fingerprint.

5

Examining and Comparing A positive comparison must be based on a number of

common characteristics between known and questioned writings.

Collecting exemplars (known writings) are critical in order to make a handwriting comparison.

Exemplars should contain some of the same words or combinations of letters that are present in the questioned document(s).

Handwriting…How is it done?6

12 Factors Used to Authenticate Handwriting

The 12 factors examiners use to determine handwriting authenticity: 1. Average amount of space between words and letters 2. Relative height, width and size of lettersHeight of the uppercase and lowercase lettersWidth of letters and the space between letters and wordsSize of letters relative to the available space

7

12 Factors Used to Authenticate Handwriting

3. Line quality – observing if the lines are smooth, free-flowing, or shaky and wavering

4. Connecting strokes – comparing the strokes between upper and lower case letters, and the strokes between the letters and the words

5. Beginning and ending strokes – observing how the writer begins and ends words, numbers, and letters

8

6. Pen lifts and separations How the writer stops to form new letters and begin words Forgeries may have lifts or separations in unusual places,

such as within a letter

7. Shading and pen pressure – the differing amounts of pressure used by the writer that make lines light or dark, narrow or wide

8. Baseline habits – analyzing if the writer’s letters stay straight or move up and down compared to a baseline

12 Factors Used to Authenticate Handwriting

9

9. Slant – analyzing the writing slant: left, right, or straight

10. Unusual letter formation – such as letters with tails or letters written backwards, etc.

11. Flourishes or embellishments – any fancy letters, curls, loops, circles, etc.

12. Letter characteristics Completeness of closed characters such as o, e, and a Dotting of I and j, and crossing of t

12 Factors Used to Authenticate Handwriting

10

10 Factors Affecting Handwriting

Factors that can affect handwriting samples 1. Writing instrument (pens, pencils, crayons, etc.) 2. Writing surface (paper, wall, napkin, etc.) 3. Underlining surface (smooth or rough) 4. Mood of the writer (undeveloped or shaky

handwriting) 5. Writing speed (slow or quick)

11

10 Factors Affecting Handwriting

6. Position of the writer (sitting or standing) 7. Position of the document (flat, vertical, or

horizontal surface) 8. Environmental exposure (temperature, humidity,

etc.) 9. Consumption of alcohol and/ or drugs 10. Injuries and/ or illnesses

12

Typescript Comparisons

Typescript is the result of machine-created documents, such as computer printers, photocopiers, fax machines, and typewriters

Defects, missing pieces, or scratches may help to identify the machine where the document originated

13

Typescript Comparisons

Computer printers – the kind of ink and toner Photocopiers – the debris patterns Fax machines – have a Transmitting Terminal Identifier (TTI) TypewritersCharacteristics of the typeface, characters, and the

ribbon

14

Typescript Comparisons

As is true for any mechanical device, use of a printing device will result in wear and damage to the machine’s moving parts.

These changes will occur in a fashion that is both random and irregular, thereby imparting individual characteristics to the printing device.

15

Digital Technology

In the cases of photocopiers, fax machines, and computer printers an examiner may be called on to identify the make and model of a machine or to compare a questioned document with test samples from a suspect machine.

A side by side comparison is made between the questioned document and the printed exemplars to compare markings produced by the machine.

16

Digital Technology

Examiners compare transitory defect marks, fax machine headers, toner, toner application methods, and mechanical and printing characteristics.

17

Altered Documents

Documents are often altered after they have been prepared. A forgery is committed to hide the original content of a document. Ways to alter documents: 1. Additions - Adding content to an already prepared

document. Infrared luminescence

Emits infrared light when exposed to blue-green lightCan be used to get results if a different ink is used than

the one on the original document

18

Altered Documents

2. Erasures One of the most common alterations. A rubber eraser, sandpaper, razor blade, or knife may

be scratched against the paper’s surface in an attempt to remove writing or type.

This irritates the top fibers of the paper which are visible under a microscope.

19

Altered Documents

3. Obliterations A document may have obliterations which are parts

that are blotted or smeared, making the original unreadable.

This is usually done with strong oxidizing agents to make the ink become colorless.

This is not visible to the naked eye, but can be seen with microscopes, or ultraviolet or infrared lighting.

20

Altered Documents

Charred Documents Sometimes documents are accidently or purposely

charred in a fire. Infrared photography or reflecting light at different

angles can sometimes reveal the document’s contents after burning.

21

Other Document Challenges

Indentations Most of the time an indented

impression is left on a paper below the primary writing

The best way to read the impression is by using an ESDA (Electrostatic Detection Apparatus) This charges the paper Pouring toner powder over the

charged paper develops the images on the indented paper.

22

Other Document Challenges

Paper To identify paper, scientists may use the following

characteristics 1. Color 2. Density 3. Watermarks

Faint design made in some paper during manufacture, which is visible when held against the light and typically identifies the maker

4. Dyes or bleaches 5. Fluorescence under UV light 6. Raw material the paper is made from 7. Thickness

23

Other Document Challenges

Ink Considered a mixture, so it can be broken down into the

different chemical components using the following lab tests 1. Thin Layer Chromatography (TLC) 2. A visible Microspectrophotometer

Studying the chemical composition can sometimes determine If a certain pen was used on a questioned document How long the ink has been on the paper

Microspectrophotometer

Thin Layer Chromatography

(TLC)

24

Other Document Challenges

Physical/ Fracture Match of separated documents – usually these documents are cut or torn and can be linked to the original source.

25

Examples of Questioned Documents

1. Checks

2. Licenses and Certificates

3. Passports

4. (Counterfeit) Money

5. Receipts

6. Lottery tickets

7. Historical documents

8. Ransom and suicide notes

26

Forgery

Forgery is an item prepared with the intent to deceive

Types 1. Blind forgery – made without a model of the

signature or the writing being forged 2. Simulated forgery – one made by copying a genuine

signature 3. Traced forgery – one made by tracing a genuine

signature

27

Counterfeit Documents

A counterfeit document is one made in exact imitation of something important or valuable with the intention of deceit.

Columbia The leading manufacturer of counterfeit U.S. currency This counterfeit production supports their growing drug

cartel

28

Counterfeit Documents

The U.S. Bureau of Engraving and Printing has established some anti-counterfeiting security features including 1. Watermarks 2. Color-shifting inks 3. Fine-line printing and microprinting 4. Enlarged, off-center portraits 5. Poor vision feature 6. Denomination-specific security thread 7. Counterfeit Detection Pen

29

Counterfeit Documents

Counterfeit detection pen – a security feature that businesses use to help eliminate receiving counterfeit bills. The pen contains iodine, and when it is used on a

counterfeit bill it produces a blue-black color. When used on an authentic bill, it produces a pale

yellow color that fades over time.

30