Forensic Document Examination: When You Need an Examiner and What a File Check Adds

Forensic document examination is the scientific examination of documents whose authenticity, genuineness or source is in dispute, carried out by a trained examiner who can report findings to a court or tribunal. It is also called questioned document examination. The examiner works from the physical evidence: handwriting and signatures, alterations, erasures, indented writing, ink, paper, printing processes and the way pages were assembled. Digital file analysis answers different questions. It reads what a PDF or Word file records about itself, so it cannot say who wrote a signature, and no examination of paper shows a file's save history.

This guide is for claims, finance, legal-operations, HR and compliance teams in the United States and Canada who hold a document that someone says is forged. It explains what an examiner does, what to preserve and send, what a file check adds, how to choose between an examiner, a file check and the issuer, and how courts treat expert evidence. It is not legal advice.

What a forensic document examiner examines

A forensic document examiner examines documents whose authenticity, genuineness or source is questioned, and reports the findings together with the reasons for them. The scope is set out in ANSI/ASB Standard 011, Scope of Expertise in Forensic Document Examination, published by the AAFS Standards Board. It says an examiner needs the knowledge to reach conclusions on, at a minimum:

• the source of writing, including signatures
• the source of machine-produced documents, typewriting, impressions and marks
• associations of the materials and devices used to produce documents, such as ink, paper and printers
• the genuineness and authenticity of a document
• the detection and decipherment of alterations, obliterations and indentations
• the preservation and restoration of legibility to damaged or illegible documents

Many requests, such as dating a document or establishing the sequence in which its parts were prepared, can need more than one type of examination. Detailed procedures exist for handwritten items, alterations, indentations, charred documents and liquid-soaked documents, and each is listed on the OSAC Registry for forensic document examination.

Questioned documents: originals, known specimens and chain of custody

A questioned document is any document whose authenticity, source or integrity is in doubt; being questioned does not mean it is forged. Three things decide how much an examiner can say.

Original or copy

An examiner works best from the original. ANSI/ASB Standard 070 tells the examiner to establish whether the questioned writing is original and, if it is not, to request the original. It adds that examining the original is preferable, and that reproductions can make it impossible to detect guide lines, the type of writing instrument, the direction and sequence of strokes, pressure, hesitations, indentations, erasures, line quality and the artifacts of cut-and-paste alterations. A photocopy or a PDF scan of a signed page therefore limits what can be examined, by an extent that varies with the case, and the standard requires the examiner to discontinue and report if the copy is too unclear for meaningful analysis or comparison. The same limit applies to every form a document takes: the figure below shows which kind of evidence a paper original, a scan or photo, a born-digital file and a printout or screenshot each keep, which is why the original stays in its original form.

Known specimens

Comparison needs known specimens, also called exemplars: writing of verified origin by the person in question. The same standard separates specimens written in the normal course of business from those written on request for comparison, and warns that specimens collected only by one party may not show the writer's full range of variation. Lack of contemporaneous writing hampers the assessment of differences, so offer both kinds, from the same period, and say how each was obtained.

Chain of custody and what to send

ASB 011 expects examiners to maintain chain of custody for the items submitted to them. ASB 070 adds that items should be handled so that later examinations are not compromised, and that document examination should come before chemical processing such as fingerprint treatment. In practice:

• Do not unstaple, fold, tape, highlight or write on the original; keep it flat in a clean envelope.
• Record who held it, when and where, from the moment you received it.
• Scan or photograph it before sending, and keep the scan with its SHA-256 hash.
• Send every related original, the known specimens and a short statement of the question.
• Do not edit, re-save or tidy digital copies; work on duplicates.

Document forensics: what a digital file can show

Document forensics also covers digital documents, where the evidence is the file and not the paper. A file records facts about itself, and a file check reads them. ISO/IEC 27037 gives guidelines for identifying, collecting, acquiring and preserving potential digital evidence; the first rule in practice is to keep the file exactly as received.

What a file can record

• Creating and saving software and dates, stored in the document properties.
• Earlier revisions. A PDF can be updated incrementally: changes are appended to the end of the file and the original contents are left unchanged, which is how a review tool can add comments without invalidating a signed original (PDF Association glossary). An earlier version of a page can therefore remain recoverable.
• Tracked changes, comments and hidden text in Word and presentation files. Microsoft's Document Inspector finds, in Word, revision marks, comments, versions, document properties and hidden text.
• Digital signatures. A certificate-based signature can be validated for integrity and certificate trust; a picture of a signature pasted on a page is only an image. The guide to checking whether a PDF has been edited shows how.
• Passages that read as AI-written, which are a lead about how text was produced, not about who signed or whether the content is true.

Where file evidence stops

• Metadata is self-reported and editable. Properties, comments and tracked changes can be changed or stripped with ordinary tools; Document Inspector exists to remove them before a file is shared. A tidy file proves nothing.
• A born-digital PDF has no ink, paper or pen pressure. There is nothing for an examiner to examine except a printout, and a printout or screenshot has lost the file's records.
• Missing earlier revisions do not clear a file. A file that was rewritten instead of appended leaves no earlier version to recover.
• A file check can show that text changed between revisions. It cannot show who changed it or whether the change was authorized.

What a Fileverity report records

Fileverity document analysis covers PDF, Word and PowerPoint files. It reports passages that read as AI-written, with page references (model FVDOC V3), and file records: creating and saving software, dates, recoverable saved revisions, structure, PDF attachments, annotations and actions, and Word or presentation revisions, comments and hidden content. It assesses PDF digital signatures as valid, invalid or indeterminate against configured trust material, and reads scanned pages with OCR and checks amount and date relationships, where a discrepancy alone does not prove alteration. Eligible embedded photos go to its FVIMG V2 image model. Each report carries a risk level from L0 to L5, the file's SHA-256 hash and, when validation succeeds, an RFC 3161 trusted timestamp. Reports can be checked on the verification page; the SHA-256 and trusted timestamp guide explains what a hash and timestamp prove.

Fileverity does not examine handwriting, ink, paper or physical security features, confirm the issuer or that the content is true, or recover every deleted version. It is not a forensic examiner and gives no expert testimony. A negative result never clears a document.

Which check do you need?

Match the check to the question. A physical examiner, a file check and the issuer answer different things, and many disputes need more than one. The figure below marks which of the three can address five common questions, and the table after it adds the detail.

When a question has parts, split it: ask the examiner about hand and paper, a file check about the file and the issuer about the facts. The guide to document fraud detection shows how to route a case between text, image, file and issuer checks.

How to choose and instruct a forensic document examiner

Check credentials and training

ASB 011 describes initial training as a structured, documented apprenticeship of at least 4,000 hours within four years. It says short overview courses and distance learning, by themselves, do not adequately prepare someone for the work, and that fraud investigation, law enforcement, banking, calligraphy or graphology are not substitutes. It lists ways to show competence: training records, proficiency testing, laboratory accreditation to ISO/IEC 17025 or individual certification under ISO/IEC 17024.

Certification by the American Board of Forensic Document Examiners has four phases: credentials, a written examination, a practical case and oral boards. The board is accredited by the Forensic Specialties Accreditation Board and certification is renewed on a five-year cycle. The American Society of Questioned Document Examiners lists members who accept private cases in a Find an Expert directory.

Ask how conclusions are expressed

Conclusion wording varies. The AAFS factsheet for OSAC 2022-S-0034, the Standard for the Expression of Source Opinions in Forensic Document Examination, describes a proposed standard, on the OSAC Registry since July 2024 and not yet a published standard, that recommends nine opinion categories, from extremely strong support for a common source through equal support to extremely strong support for different sources. It requires the laboratory or examiner to provide or make available the full scale and prohibits a categorical exclusionary opinion in a handwriting examination. It frames opinions as support for one of two competing propositions, for example that the signatory signed a page or that someone else did.

Ask which scale the examiner uses, what each term means and what limits the strength of the opinion. ASB 070 expects the examiner's documentation to give the bases and reasons for each conclusion and to record limitations.

Know the admissibility test

In United States federal courts, Federal Rule of Evidence 702 lets a qualified expert give an opinion only if the proponent shows it is more likely than not that the testimony will help the trier of fact, rests on sufficient facts or data, is the product of reliable principles and methods, and reflects a reliable application of them to the case. The amendment took effect on December 1, 2023 (Supreme Court order). The Committee Note says forensic experts should avoid assertions of absolute or one hundred percent certainty, or of certainty to a reasonable degree of scientific certainty, when the methodology is subjective. Rule 901(b)(3) allows authentication by an expert's comparison with an authenticated specimen. State courts apply their own rules.

In Canada, R. v. Mohan sets the threshold for expert opinion: relevance, necessity, no exclusionary rule and a properly qualified expert. White Burgess Langille Inman v. Abbott and Haliburton Co., 2015 SCC 23 describes a second, discretionary gatekeeping step in which the judge weighs the risks and benefits of admitting the evidence. It also holds that an expert must be able and willing to give fair, objective and non-partisan evidence, and that a witness who cannot do so is not properly qualified, although exclusion at that threshold stage is reserved for very clear cases.

Limit what the examiner learns, and what the report should say

ASB 070 tells the examiner to endeavor to avoid exposure to potentially biasing information that is not necessary for the evaluation. Send the questioned item, the known specimens and a neutral statement of the question; leave out theories about who did it, the amount at stake and the result you hope for.

Ask the report to state the question as understood; each item received, original or copy, and its condition; the specimens and how each was obtained; the methods applied; the findings with their bases; the limitations; the opinion scale and its meaning; and the alternatives considered.

Worked example: a disputed contract amendment

Consider a hypothetical dispute. Marlowe Supply Co. says that Amendment 2 to its service contract with Northgate Facilities Ltd. raised the monthly fee from $18,000 to $21,500 from March 1. Northgate says it agreed to $19,000, and that its officer never signed a page showing $21,500. Marlowe produces a three-page PDF described as a scan of the signed amendment. All names, dates and amounts are fictitious.

The file check narrows the question; it does not answer it. The next steps split by question:

• The file. Keep the PDF as received and record its hash. Ask Marlowe in writing to explain the second save and to produce the scanner output and the email that first carried the scan.
• The signature and the pages. The original wet-ink pages are what an examiner needs to address whether the signature is genuine and whether page 2 belongs with page 3, through paper stock, printing, staple holes, indentations and page order. Ask Marlowe to preserve the original untouched, gather Northgate's known specimens from the same period, and instruct an examiner through counsel with two propositions: the officer signed page 3 as presented, or someone else did.
• The counterparties. Ask Northgate for its executed copy and internal approval, and compare Marlowe's invoices since March with what Northgate paid; they show which fee the parties actually applied.

Each answer settles a different piece, and none replaces the others. The record states what was observed, confirmed and left open; it does not call the document forged.

A review record to keep

Keep observation, inference and confirmation separate.

"Page 2 text differs between revisions" is an observation. "Northgate's executed copy shows $19,000" is a confirmation. "The signature remains unresolved pending the original" is an outcome.

Common questions

Can a forensic document examiner work from a photocopy or PDF?

Sometimes, with limits. ASB 070 says examining the original is preferable and lists what a reproduction can hide, from stroke sequence and pressure to erasures and cut-and-paste artifacts. The standard requires the examiner to discontinue and report if the copy is too poor for meaningful analysis or comparison, so ask for the original early.

Can the age of a document be determined?

Sometimes, but it is one of the harder questions. ASB 011 lists dating among requests that can need more than one type of examination, and describes comparing elements such as paper, ink and printing with a standard reference collection to determine age, production history or authenticity. A digital file's dates are self-reported, and a trusted timestamp shows only that a hash existed at a given time.

Is forensic document examination the same as handwriting analysis (graphology)?

No. ASB 011 states that forensic document examination does not involve studying handwriting to assess personality or character, and that graphology is no foundation for competence in the field. An examiner compares handwriting features to determine its source, and the work extends to alterations, indentations, ink, paper and printing.

Can software detect a forged signature?

Not in a way that replaces an examiner. Comparing a questioned handwritten signature with known specimens is work for a qualified examiner, preferably from the original, and Fileverity does not compare handwriting. Software can validate a certificate-based digital signature in a PDF and report whether the document changed afterward, which is a different question. ASB 011 notes that examiners can also examine electronically captured writing and signatures; that is a comparison of the captured signature, not a validation of a certificate-based digital signature.

By Yang Zheng · Reviewed by Bill Liu