How It’s Done
Evidence That May Be Examined
Questioned material may consist of identification cards, contracts, wills, titles and deeds, seals, stamps, bank checks, handwritten correspondence, machine-generated documents (such as those from photocopiers, fax machines, and printers), currency and electronic documents. In some circumstances, graffiti and digital signatures may be examined; however, the client should be aware that the examination of these types of evidence can be problematic.
Documents that don’t contain visible identifiable marks may contain valuable impression evidence if they were underneath other documents when the writing was performed. Even documents that were shredded or burned may prove useful if reconstructed.
In addition, writing instruments, rubber stamps, envelopes and makes/models of office equipment in the suspect’s possession may be collected by the investigator. In digital documents, evidence could even be culled from the metadata of electronic signature files, providing information such as who the author is and when the document was written.
Collecting the Known and Unknown
When conducting examinations, forensic document examiners must have known specimens to which they compare the material in question. These samples may come from any number of known sources, such as a particular ink manufacturer or machine.
In cases involving handwriting, samples are usually divided into two types: requested writing specimens and collected writing specimens. Requested specimens are writings dictated by the investigator to the writer. These specimens are created under carefully controlled conditions, with the writer being closely monitored. Collected writing specimens, however, are writings that were completed by the subject prior to the investigation. Good sources of writing specimens may include items such as cancelled checks, letters, diaries, signed receipts, medical records, real estate contracts, tax records or other signed legal documents.
Who Conducts the Analysis
The analysis should be performed by a qualified forensic document examiner, preferably one who is a member of a well-established professional association such as the American Board of Forensic Document Examiners (ABFDE) or the American Society of Questioned Document Examiners (ASQDE). Membership requirements for these associations vary; however, an examiner typically must have completed a two-year, full-time training program under the guidance of a qualified forensic document examiner. To maintain membership in good standing and keep their skills current, examiners are required to complete continuing education.
How and Where the Analysis Is Performed
Forensic document examiners either work as private examiners within their own laboratory, or for publicly funded laboratories. If an agency does not have questioned documents analysis capabilities, investigators may opt to send the evidence to a nearby lab, or retain a private examiner.
The techniques and tools used in forensic document examinations leverage well-established principles of physics and chemistry. A typical Questioned Documents unit in a crime laboratory is equipped with microscopes, digital imaging instrumentation, infrared and ultraviolet light sources, video analysis tools and specialized equipment including electrostatic detection devices (EDD) and materials to perform analytical chemistry.
Many forensic document examiners use only non-destructive techniques that use light and/or electrostatics to examine documents for indented impression evidence or ink differentiation. However, a few examination techniques, such as liquid chromatography, are considered destructive because they require removal of small samples of ink from the questioned documents. These types of examinations may be sent off to laboratories that specialize in this type of ink analysis.
For analyses of documents created by typewriters, fax machines, or printers, examiners may rely on various databases created for comparison purposes. During handwriting analyses, examiners compare samples provided from particular populations. Certain agencies, such as the U.S. Secret Service and the German Federal Police, maintain larger databases. For example, the Forensic Information System for Handwriting (FISH) maintained by the U.S. Secret Service Forensic Laboratory contains handwriting samples from tens of thousands of writers.
Revealing text from indented impressions ― Documents that may contain indented impressions not visible to the naked eye can be visualized through the use of an Electrostatic Detection Device (EDD) such as the Electrostatic Detection Apparatus (ESDA). An EDD uses applied charges and toner to visualize areas of indented writing, making them visible to the eye. The ESDA uses the principle that indented areas of the document carry less negative charge than surrounding areas. This causes the toner used in the EDD to be attracted to these areas, revealing indentations that are present.
Using this technique, indented impressions have been recovered from up to seven layers of paper beneath the original writings. Research has demonstrated that impressions can be successfully visualized from documents up to 60 years old, provided the papers are not mishandled or stored improperly.
Detecting alterations, obliterations, erasures and page substitutions ― Alterations, obliterations and erasures not visible to the human eye can often be detected through use of photography and other imaging devices that utilize ultraviolet and infrared wavelengths of light. Using radiation filtered at various wavelengths, an imaging instrument such as a video spectral comparator (VSC) can reveal writing that has been added with a different ink, or has been altered or removed by exploiting variations in the way different inks respond to different wavelengths of light. For example, under certain light sources combined with an infrared filter, a document containing information written in ink that has faded over time may be enhanced or processed to appear darker and therefore more legible.
Obliterated note viewed with visible light. (Courtesy of Marie Durina)
Same note viewed with infrared radiation. (Courtesy of Marie Durina)
Determining individual dye components ― An examination called liquid chromatography can be conducted to identify the chemical composition of inks on a document. In this technique, a small cutting from the questioned document is dissolved in a solvent and analyzed. This is one of the few destructive techniques employed by the document examiner. The inks can be compared to the International Ink Library, a database maintained by the U.S. Secret Service that contains data on more than 9,500 inks that have been manufactured since 1920.
Typewritten and machine-printed documents ― Documents created on a typewriter or printed with ink jet, laser printers, fax machines and photocopiers may be sourced to a particular make or model, or even to a specific machine. The printing process used to prepare documents can also be identified. When possible, the examiner should obtain known standards and any available accessories from the machine in question and the machine itself should be submitted for examination.
Seals and stamps ― Questioned documents bearing rubber stamp impressions, embossed seals, watermarks, or other mechanically printed marks may be submitted for examination. When possible, it is best to provide the examiner with any suspected devices associated with the questioned document that may have been involved in its preparation. This includes writing instrument(s), papers, or other substrates, rubber stamp(s), sealing devices (such as notary seals), printing devices or other mechanisms.
To illustrate the value of a manufacturer’s mark, consider a 1989 case when a young girl was kidnapped and murdered. Investigators called in forensic document examiners to examine the plastic garbage bag in which the victim was found. Minute markings created by the heat-seal process used in manufacturing such bags enabled investigators to determine that the bag was manufactured on the same machine within seconds of other bags found in the parents’ house. This was key evidence that resulted in the conviction of the girl’s mother for murder. (Source: World of Forensic Science, ©2006 Gale Cengage.)
Examination of handwriting ― When a sufficient amount of writing from two different people is closely examined, there are always identifiable differences. Comparisons of writing samples take into consideration a wide variety of handwriting characteristics including word and letter spacing, slant or slope, speed, pen position, use of capitalization, embellishments, legibility, use of punctuation, and proportion of letters and other attributes.
For example, one person may form the letter “O” in a clockwise motion, while another may form the same letter in a counter-clockwise motion. A particular writer may form the letter “M” using an upward-moving “arch” formation (similar to the McDonald’s Restaurant sign), while another prefers to make a “garland” form of “M”, forming this letter with a “U” motion to resemble the garland on a Christmas tree. Document examiners take into account the various combinations of features present within the writing sample as a whole. In addition, examiners look for features such as hesitations in the natural flow of writing, possible retouching or unnatural tremors. These may indicate that an unnatural writing process (e.g., simulation or disguise) has been employed.
No one writes with machine-like precision every time, and variations are evident in a person’s handwriting even within the same document. For example, if a person writes an entire page of signatures, each one will vary slightly. A trained forensic document examiner can discriminate between natural variations in a writer’s own handwriting and significant differences denoting different writers.
To conduct handwriting comparisons, the investigator should obtain known writing samples that are similar in character to the document in question. If it is written in cursive, it should be compared to known cursive writing. If it contains upper- and lower-case letters, the known writings must also contain upper- and lower-case letters. Wherever possible, the investigator should also obtain known writing containing similar combinations of letters and numbers seen in the questioned documents. For comparison purposes, it is recommended that investigators obtain 20–30 repetitions of signatures, 15–20 repetitions of bank checks, 3–4 repetitions of entire written letters.
The investigator should also attempt to obtain known writing that is prepared around the same time period as the questioned writing. This is particularly important in cases involving writing from young people (up to mid-teens), as writing formation may still be at a developmental stage, and by elderly persons, as writing may deteriorate with age or illness.