The scientific examination of documents has been an integral part of forensic science for almost a hundred years and many of the techniques developed over that period are still in use today. However, time does not stand still. The technology used to produce documents continues to evolve; the methods used to produce forgeries are ever more sophisticated; the expectations of lawyers and Courts are yet more demanding.

But forensic science is not sitting on its hands either – advances in techniques and technology mean that the forensic document examiner is fighting back.

Document examiners are trained scientists. This means that they are trained in scientific method and objectivity, in assessing evidence and drawing conclusions. A good forensic document examiner is expected to hold a University Degree in a basic science – these individuals invest in their training. They have trained alongside forensic scientists and in established forensic science laboratories. They can demonstrate their continued education, having a record of attending meetings, producing research papers and refereeing journals. Very importantly, any forensic document examiner you wish to employ should have invested in equipment and laboratory facilities.

Wrongly, there is a perception that the forensic examination of documents, and particularly handwriting, is something which anybody can carry out on their kitchen table. No – forensic document examination takes place in a properly equipped forensic document laboratory. One group in particular, graphologists, frequently offer their services to the legal profession as forensic handwritings specialists. (These individuals are trained in the pseudo-science of determining personality features from handwriting.) This has absolutely nothing to do with the forensic document examination, and identification of handwritings and signatures as carried out by forensic scientists. Another group who offer services to the legal profession are scientists who have had a long career in official forensic science laboratories who then retire and, without a stick of equipment, reckon to provide the same level of work as they did in their fully equipped forensic document laboratories. They can’t – the science has moved on. No matter how impressive their CV, an invitation to hold a conference at their ‘laboratory’ will quickly clarify their actual working status!

Actually the main areas of work in this discipline are same as they have been for a long time:

• The identification of individuals through their handwriting.
• Determining whether signatures are genuine or simulations.
• Determining the origin and history of documents.

Handwriting and signatures

The forensic examination of handwritings is very well documented and tested – indeed, the basic principles have been unchanged for many years. It is well established that handwriting is identifiable and everybody’s handwriting consists of a particular combination of character and figure forms which in the mature adult are reproduced unconsciously. However, the particular challenge of handwriting and signature comparisons is that there is a degree of natural variability in everyone’s handwritings and signatures, both from day to day and over the years. While the approach is largely qualitative and subjective, it is no less scientific. And over the last thirty years much effort has been directed into the electronic recognition of handwritings, with some success with the Forensic Information System for Handwriting (FISH) in Germany, the Dutch ‘Script’ system and the Center of Excellence for Document Analysis and Recognition (CEDAR) system in the United States. These electronic processes electronically assess a number of features of the handwriting , for example slope, the area within characters such as ‘o’, spacing and relative proportions; large databases of handwritings have emerged for further research. The majority of these systems are targeted at criminal cases, where examples of handwritings can be collected under very controlled conditions on specialised documents which allow easy collection of the data.

(Course-of-business documents, while providing a more accurate picture of a person’s handwriting at a particular time. are more difficult to evaluate, since the documents involved often include backgrounds which interfere with the collection process.) In addition, in North America forensic scientists have developed a handwriting recognition process which allows large quantities of handwritings to be handled, not so much for the identification of features but for pinpointing useful features for direct comparison.

The basic principles of signature examination were established back in the early twentieth century and it has remained more or less consistent over the years. Signatures are very highly specialised pieces of handwriting and their examination remains very challenging, largely because these are very small pieces of handwriting for comparison. Unlike the situation where an entire page of text is available with hundreds of points of comparison, a small signature provides very much less and it is for this reason in particular that the examination of original signatures rather than copies is so important. The examiner needs to be able to use every feature of the handwriting available. To make life more difficult signatures also demonstrate natural variation. Individuals can be very different in the amount of variation found in their signatures. The degree of variation observed in the signature has to be assessed before any useful comparison can be carried out with a questioned signature. It is essential that sufficient examples of the genuine signature from the relevant time be available in order to determine this range of variation. It is only at that point that the examiner can determine whether the questioned signature falls within or without that range of variation and whether any differences are significant or merely further variation.

Signatures are frequently the target of simulation. Those attempting simulations employ a number of different methods to achieve pictorial similarity to the genuine signature. For example, they may copy them freehand. But this is difficult – the simulator has to achieve a passable copy while maintaining the fluency of the signature. The result of this conflict is mistakes in detailed structure within the signature. Other aids to simulation may be used but cooperation between forensic document examiners and equipment manufacturers has led to the development of a range of equipment to identify these. In particular the Video Spectral Comparator can be used in a number of different modes to detect, for example, guide lines. Dyes within inks react differently under different lighting regimes produced by this instrument; some inks appear transparent, revealing any pencil guide lines associated with a questioned signature. Another type of guide line may be produced in the form of impressions – here a document bearing a genuine signature is placed on the document where a signature is required and the genuine signature heavily overwritten. Impressions of that genuine signature will then appear on the document beneath, which are then inked in. However, examination of that signature with obliquely directed light or a combination of obliquely directed light and other lighting systems will reveal those impressions.

Using the frame store facility of the Video Spectral Comparator, the proportions, slopes and relative positioning of different signatures can be compared directly and accurately measured. This approach is very valuable, particularly when dealing with simple signatures which contain few structures for comparison. In a simple signature consisting, say, of only of a couple of vertical loops, measurements can be taken of such features as the height of loops, the point of entry, the slope of the signature, and data from individual signatures processed and compared. Such measurements permit the forensic document examiner to see whether the signatures form different populations.

With the wide availability of scanners and software which permit the electronic capture and manipulation of images, the scope for introducing genuine signatures into fraudulent documents has increased dramatically. The products of ink-jet printers, which often appear to the unaided eye as being ordinary ink signatures produced by a pen, can be examined microscopically to identify the manner in which they have been introduced into the document. Such programs as Photoshop, which provide the fraudster with the ability to alter the dimensions, slope or proportions of elements of signatures so as to disguise their origin, also work in reverse to the forensic document examiner’s advantage, who can use them to reverse the process and identify the origin of a particular signature.

Fig. 1: The Video Spectral Comparator – the workhorse of a modern forensic document laboratory.

Fig 2: The signature above is an original ink signature.

Fig 3: The original signature has been scanned electronically, squashed horizontally and stretched vertically prior to being transposed into a fraudulent document using an ink jet printer (right). It has (superficially at any rate) the appearance of being an independently written signature within the normal range of variation of the writer.

Fig 4: A Medical Certificate seen above in normal light.

Fig 5: The same Medical Certificate under conditions which make one ink transparent and the other fluoresce, thus showing the use of more than one pen.

One of the most frequently requested examinations is to determine the date when a particular signature or piece of writing was made. Sadly, there are no reliable techniques for dating ink on paper despite the efforts of forensic scientists over the last thirty years. Once an ink line is made on a piece of paper, certain volatile components of the ink disperse into the atmosphere – much effort has been made to determine the rate at which these volatile components do so over time. For example phenoxyethanol present in ballpoint pen ink decreases very rapidly immediately after writing and then more slowly over a longer period. However, by two years there are unlikely to be any measurable changes in the amount of this compound in the ink – any realistic estimate of the age of ink can only be carried out within two years of its writing. That said, this remains a highly controversial area since some inks release phenoxyethanol faster than others and the rate of release is also dependent on the conditions under which the document is stored: one stored at high temperature will ‘age’ much more rapidly than those kept at lower temperatures. At this time no forensic document examiners in the United Kingdom carry out ink dating services. Indeed, there are very few laboratories worldwide that carry out this work at all. There are a few in the United States but not all of these can be considered as reliable.

But this does not mean that establishing the origin and history of documents is impossible. A number of more oblique techniques can be employed, covering the examination of inks, the details, structures and appearances of pen lines, printing and paper.

The Video Spectral Comparator again plays a vital role here, since it has been developed very specifically to assist the forensic document examiner in the discrimination of inks, using entirely non-destructive processes. However, sometimes it is necessary to resort to a destructive type of process to distinguish between inks. For example Thin Layer Chromatography is used to separate the dye components of inks following the removal of a small section of a pen line, which is then extracted in a solvent.

However, there are other components in inks besides dyes and the largely non-destructive technique of Raman spectroscopy has been developed to look at the dyes and these other components. Further destructive analysis can involve Gas Chromatography-Mass Spectroscopy but this equipment is only generally available in highly specialised analytical laboratories.

Some pens, and particularly ballpoint pens, do not deposit ink uniformly during writing. Quantities of dirt and debris can gather between the ball of the pen and its surrounding housing – this results in ink being scraped off the ball during the writing process. Small defects in the ball housing will produce a similar effect. The resulting ink line demonstrates striations and, when viewed microscopically, can appear highly characteristic. The pattern of the striation within the pen line will remain the same while the pen is in the same position within the hand. If the pen is put down and taken up again so that the pen orientation is different, then the striation pattern will appear different. So, for instance, if two pieces of handwriting allegedly written a number of months or years apart can be shown to have precisely the same striation pattern, then there is positive evidence that they were actually written at the same time.

There are cases where is it important to know the sequence of writing, or writing and printing, on a particular document. In fact, this is extremely difficult, though it is easier to determine the sequence of pen lines and printing. It is often required where there is a dispute as to whether a document was signed before the details were printed. The process of a pen crossing the toner deposits from a laser printer changes the appearance of the toner. Very often in the case of ballpoint pens the oily deposits of the ink can be seen on top of the toner, in other cases the compression of the toner surface reflects light differently. Appropriate illumination of the toner demonstrates these differences in reflection and the resulting image can be captured.

Actually, identifying the sequence of printing and pen lines can sometimes be achieved when there is no direct intersection between the pen line and the printing itself. Although a laser-printed document may appear white where there is no deposition of toner image; in fact when viewed under high magnification stray toner particles are scattered all over the surface of the paper. Toner particles over-written by a pen line have quite a different appearance from those which have not.

Cheap ink-jet printing is widely available. Such printing is generally very consistent, though complicated by the fact that printers can print in a variety of modes; nevertheless, the microscopic appearance of printing from printers of different manufacturers can sometimes be differentiated. And where a significant difference is found in the microscopic image of the printing from one page to another of a multi-page document, this is a strong indicator that pages have different origins. Sometimes it is even possible to identify faults in ink-jet printing produced by the blockage of individual nozzles in the print head, resulting in a white line appearing through the printing. Though these faults can be eliminated very quickly, by employing the cleaning routine of the printer, while they persist the pattern of faults throughout printing can link documents together. Similarly, different modes of printing which appear similar to the unaided eye can be distinguished microscopically so that modern laser toner deposits can be distinguished from other types of printing such as offset lithography, ink-jet printing or thermal printing. It is not unknown for documents to be produced using printing technology which was not available at the stated date of the document!

The combination of computer software and printers results in the availability of a huge range of different typefaces. However, a number of different typefaces, although appearing to be very similar to the unaided eye, can be distinguished by the examination of small details. The Arial and Helvetica typefaces for example, appear very similar but on much closer inspection can be seen to differ in tiny details such as length of serifs, curvature of elements and internal proportions. Electronic superimposition of printing from different documents can reveal these small differences. This process can be used to identify whether a particular document is consistent throughout or whether additions have been made.

Although the range of typefaces available is very large, many individuals tend to resort to the default typeface in their particular word processing package or printer. This has led to their undoing when trying to create an ‘old’ document by using a typeface which has not been available until a much later date. Beware documents dated in the 1980s but typed in Times New Roman – they are unlikely to be genuine.

The Electrostatic Detection Apparatus (ESDA) process for the identification of impressions on documents has now been available to the forensic document examiner for the last thirty years. Impressions of handwritings are produced when handwritings are made on a particular document which at the time of writing is lying on top of other documents. The resulting impressions are often not visible to the unaided eye but can be visualised using this non-destructive electrostatic technique. Such impressions can be used to identify the origin of documents and occasionally when associated with documents of a known date, provide an indication of when a particular document was produced. Sometimes the technique can be used to determine the sequence of writings from page to page, although this is a difficult technique and such examinations often prove inconclusive.

An increasing number of scientific techniques now provide a formidable arsenal in the hands of a properly trained and equipped forensic document examiner. These are at the disposal of the legal profession in their investigations of fraud and forgery. Active research continues to develop yet more techniques.

Dr Audrey Giles leads the scientific work of the Giles Document Laboratory. This article is based on a lecture given on 22 January 2010 at the Chancery Bar Association, London.

Back to TQR