The scientific examination of documents has been an integral
part of forensic science for almost a hundred years and many of the
techniques developed over that period are still in use today.
However, time does not stand still. The technology used to produce
documents continues to evolve; the methods used to produce
forgeries are ever more sophisticated; the expectations of lawyers
and Courts are yet more demanding.
But forensic science is not sitting on its hands either –
advances in techniques and technology mean that the forensic
document examiner is fighting back.
What is a forensic document examiner? Who to
instruct?
Document examiners are trained scientists. This means that they
are trained in scientific method and objectivity, in assessing
evidence and drawing conclusions. A good forensic document examiner
is expected to hold a University Degree in a basic science – these
individuals invest in their training. They have trained alongside
forensic scientists and in established forensic science
laboratories. They can demonstrate their continued education,
having a record of attending meetings, producing research papers
and refereeing journals. Very importantly, any forensic document
examiner you wish to employ should have invested in equipment and
laboratory facilities.
Wrongly, there is a perception that the forensic examination of
documents, and particularly handwriting, is something which anybody
can carry out on their kitchen table. No – forensic document
examination takes place in a properly equipped forensic document
laboratory. One group in particular, graphologists, frequently
offer their services to the legal profession as forensic
handwritings specialists. (These individuals are trained in the
pseudo-science of determining personality features from
handwriting.) This has absolutely nothing to do with the forensic
document examination, and identification of handwritings and
signatures as carried out by forensic scientists. Another group who
offer services to the legal profession are scientists who have had
a long career in official forensic science laboratories who then
retire and, without a stick of equipment, reckon to provide the
same level of work as they did in their fully equipped forensic
document laboratories. They can’t – the science has moved on. No
matter how impressive their CV, an invitation to hold a conference
at their ‘laboratory’ will quickly clarify their actual working
status!
The three main areas of forensic document
examination
Actually the main areas of work in this discipline are same as
they have been for a long time:
- The identification of individuals through their
handwriting.
- Determining whether signatures are genuine or simulations.
- Determining the origin and history of documents.
Handwriting and signatures
The forensic examination of handwritings is very well documented
and tested – indeed, the basic principles have been unchanged for
many years. It is well established that handwriting is identifiable
and everybody’s handwriting consists of a particular combination of
character and figure forms which in the mature adult are reproduced
unconsciously. However, the particular challenge of handwriting and
signature comparisons is that there is a degree of natural
variability in everyone’s handwritings and signatures, both from
day to day and over the years. While the approach is largely
qualitative and subjective, it is no less scientific. And over the
last thirty years much effort has been directed into the electronic
recognition of handwritings, with some success with the Forensic
Information System for Handwriting (FISH) in Germany, the Dutch
‘Script’ system and the Center of Excellence for Document Analysis
and Recognition (CEDAR) system in the United States. These
electronic processes electronically assess a number of features of
the handwriting , for example slope, the area within characters
such as ‘o’, spacing and relative proportions; large databases of
handwritings have emerged for further research. The majority of
these systems are targeted at criminal cases, where examples of
handwritings can be collected under very controlled conditions on
specialised documents which allow easy collection of the data.
(Course-of-business documents, while providing a more accurate
picture of a person’s handwriting at a particular time. are more
difficult to evaluate, since the documents involved often include
backgrounds which interfere with the collection process.) In
addition, in North America forensic scientists have developed a
handwriting recognition process which allows large quantities of
handwritings to be handled, not so much for the identification of
features but for pinpointing useful features for direct
comparison.
The basic principles of signature examination were established
back in the early twentieth century and it has remained more or
less consistent over the years. Signatures are very highly
specialised pieces of handwriting and their examination remains
very challenging, largely because these are very small pieces of
handwriting for comparison. Unlike the situation where an entire
page of text is available with hundreds of points of comparison, a
small signature provides very much less and it is for this reason
in particular that the examination of original signatures rather
than copies is so important. The examiner needs to be able to use
every feature of the handwriting available. To make life more
difficult signatures also demonstrate natural variation.
Individuals can be very different in the amount of variation found
in their signatures. The degree of variation observed in the
signature has to be assessed before any useful comparison can be
carried out with a questioned signature. It is essential that
sufficient examples of the genuine signature from the relevant time
be available in order to determine this range of variation. It is
only at that point that the examiner can determine whether the
questioned signature falls within or without that range of
variation and whether any differences are significant or merely
further variation.
Signatures are frequently the target of simulation. Those
attempting simulations employ a number of different methods to
achieve pictorial similarity to the genuine signature. For example,
they may copy them freehand. But this is difficult – the simulator
has to achieve a passable copy while maintaining the fluency of the
signature. The result of this conflict is mistakes in detailed
structure within the signature. Other aids to simulation may be
used but cooperation between forensic document examiners and
equipment manufacturers has led to the development of a range of
equipment to identify these. In particular the Video Spectral
Comparator can be used in a number of different modes to detect,
for example, guide lines. Dyes within inks react differently under
different lighting regimes produced by this instrument; some inks
appear transparent, revealing any pencil guide lines associated
with a questioned signature. Another type of guide line may be
produced in the form of impressions – here a document bearing a
genuine signature is placed on the document where a signature is
required and the genuine signature heavily overwritten. Impressions
of that genuine signature will then appear on the document beneath,
which are then inked in. However, examination of that signature
with obliquely directed light or a combination of obliquely
directed light and other lighting systems will reveal those
impressions.
Using the frame store facility of the Video Spectral Comparator,
the proportions, slopes and relative positioning of different
signatures can be compared directly and accurately measured. This
approach is very valuable, particularly when dealing with simple
signatures which contain few structures for comparison. In a simple
signature consisting, say, of only of a couple of vertical loops,
measurements can be taken of such features as the height of loops,
the point of entry, the slope of the signature, and data from
individual signatures processed and compared. Such measurements
permit the forensic document examiner to see whether the signatures
form different populations.
With the wide availability of scanners and software which permit
the electronic capture and manipulation of images, the scope for
introducing genuine signatures into fraudulent documents has
increased dramatically. The products of ink-jet printers, which
often appear to the unaided eye as being ordinary ink signatures
produced by a pen, can be examined microscopically to identify the
manner in which they have been introduced into the document. Such
programs as Photoshop, which provide the fraudster with the ability
to alter the dimensions, slope or proportions of elements of
signatures so as to disguise their origin, also work in reverse to
the forensic document examiner’s advantage, who can use them to
reverse the process and identify the origin of a particular
signature.
Fig. 1: The Video Spectral Comparator – the
workhorse of a modern forensic document laboratory.
Fig 2: The signature above is an original ink
signature.
Fig 3: The original signature has been scanned
electronically, squashed horizontally and stretched vertically
prior to being transposed into a fraudulent document using an ink
jet printer (right). It has (superficially at any rate) the
appearance of being an independently written signature within the
normal range of variation of the writer.
Fig 4: A Medical Certificate seen above in
normal light.
Fig 5: The same Medical Certificate under
conditions which make one ink transparent and the other fluoresce,
thus showing the use of more than one pen.
Origin and history of documents
One of the most frequently requested examinations is to
determine the date when a particular signature or piece of writing
was made. Sadly, there are no reliable techniques for dating ink on
paper despite the efforts of forensic scientists over the last
thirty years. Once an ink line is made on a piece of paper, certain
volatile components of the ink disperse into the atmosphere – much
effort has been made to determine the rate at which these volatile
components do so over time. For example phenoxyethanol present in
ballpoint pen ink decreases very rapidly immediately after writing
and then more slowly over a longer period. However, by two years
there are unlikely to be any measurable changes in the amount of
this compound in the ink – any realistic estimate of the age of ink
can only be carried out within two years of its writing. That said,
this remains a highly controversial area since some inks release
phenoxyethanol faster than others and the rate of release is also
dependent on the conditions under which the document is stored: one
stored at high temperature will ‘age’ much more rapidly than those
kept at lower temperatures. At this time no forensic document
examiners in the United Kingdom carry out ink dating services.
Indeed, there are very few laboratories worldwide that carry out
this work at all. There are a few in the United States but not all
of these can be considered as reliable.
But this does not mean that establishing the origin and history
of documents is impossible. A number of more oblique techniques can
be employed, covering the examination of inks, the details,
structures and appearances of pen lines, printing and paper.
The Video Spectral Comparator again plays a vital role here,
since it has been developed very specifically to assist the
forensic document examiner in the discrimination of inks, using
entirely non-destructive processes. However, sometimes it is
necessary to resort to a destructive type of process to distinguish
between inks. For example Thin Layer Chromatography is used to
separate the dye components of inks following the removal of a
small section of a pen line, which is then extracted in a
solvent.
However, there are other components in inks besides dyes and the
largely non-destructive technique of Raman spectroscopy has been
developed to look at the dyes and these other components. Further
destructive analysis can involve Gas Chromatography-Mass
Spectroscopy but this equipment is only generally available in
highly specialised analytical laboratories.
Some pens, and particularly ballpoint pens, do not deposit ink
uniformly during writing. Quantities of dirt and debris can gather
between the ball of the pen and its surrounding housing – this
results in ink being scraped off the ball during the writing
process. Small defects in the ball housing will produce a similar
effect. The resulting ink line demonstrates striations and, when
viewed microscopically, can appear highly characteristic. The
pattern of the striation within the pen line will remain the same
while the pen is in the same position within the hand. If the pen
is put down and taken up again so that the pen orientation is
different, then the striation pattern will appear different. So,
for instance, if two pieces of handwriting allegedly written a
number of months or years apart can be shown to have precisely the
same striation pattern, then there is positive evidence that they
were actually written at the same time.
There are cases where is it important to know the sequence of
writing, or writing and printing, on a particular document. In
fact, this is extremely difficult, though it is easier to determine
the sequence of pen lines and printing. It is often required where
there is a dispute as to whether a document was signed before the
details were printed. The process of a pen crossing the toner
deposits from a laser printer changes the appearance of the toner.
Very often in the case of ballpoint pens the oily deposits of the
ink can be seen on top of the toner, in other cases the compression
of the toner surface reflects light differently. Appropriate
illumination of the toner demonstrates these differences in
reflection and the resulting image can be captured.
Actually, identifying the sequence of printing and pen lines can
sometimes be achieved when there is no direct intersection between
the pen line and the printing itself. Although a laser-printed
document may appear white where there is no deposition of toner
image; in fact when viewed under high magnification stray toner
particles are scattered all over the surface of the paper. Toner
particles over-written by a pen line have quite a different
appearance from those which have not.
Cheap ink-jet printing is widely available. Such printing is
generally very consistent, though complicated by the fact that
printers can print in a variety of modes; nevertheless, the
microscopic appearance of printing from printers of different
manufacturers can sometimes be differentiated. And where a
significant difference is found in the microscopic image of the
printing from one page to another of a multi-page document, this is
a strong indicator that pages have different origins. Sometimes it
is even possible to identify faults in ink-jet printing produced by
the blockage of individual nozzles in the print head, resulting in
a white line appearing through the printing. Though these faults
can be eliminated very quickly, by employing the cleaning routine
of the printer, while they persist the pattern of faults throughout
printing can link documents together. Similarly, different modes of
printing which appear similar to the unaided eye can be
distinguished microscopically so that modern laser toner deposits
can be distinguished from other types of printing such as offset
lithography, ink-jet printing or thermal printing. It is not
unknown for documents to be produced using printing technology
which was not available at the stated date of the document!
The combination of computer software and printers results in the
availability of a huge range of different typefaces. However, a
number of different typefaces, although appearing to be very
similar to the unaided eye, can be distinguished by the examination
of small details. The Arial and Helvetica typefaces for example,
appear very similar but on much closer inspection can be seen to
differ in tiny details such as length of serifs, curvature of
elements and internal proportions. Electronic superimposition of
printing from different documents can reveal these small
differences. This process can be used to identify whether a
particular document is consistent throughout or whether additions
have been made.
Although the range of typefaces available is very large, many
individuals tend to resort to the default typeface in their
particular word processing package or printer. This has led to
their undoing when trying to create an ‘old’ document by using a
typeface which has not been available until a much later date.
Beware documents dated in the 1980s but typed in Times New Roman –
they are unlikely to be genuine.
The Electrostatic Detection Apparatus (ESDA) process for the
identification of impressions on documents has now been available
to the forensic document examiner for the last thirty years.
Impressions of handwritings are produced when handwritings are made
on a particular document which at the time of writing is lying on
top of other documents. The resulting impressions are often not
visible to the unaided eye but can be visualised using this
non-destructive electrostatic technique. Such impressions can be
used to identify the origin of documents and occasionally when
associated with documents of a known date, provide an indication of
when a particular document was produced. Sometimes the technique
can be used to determine the sequence of writings from page to
page, although this is a difficult technique and such examinations
often prove inconclusive.
An increasing number of scientific techniques now provide a
formidable arsenal in the hands of a properly trained and equipped
forensic document examiner. These are at the disposal of the legal
profession in their investigations of fraud and forgery. Active
research continues to develop yet more techniques.
Dr Audrey Giles leads the scientific work of the Giles Document
Laboratory. This article is based on a lecture given on 22 January
2010 at the Chancery Bar Association, London.
Back to TQR