Forensic Examination of Handwriting and Documents

Abstract

The goal of this paper is to provide an overview of the instruments and methods that experts currently use for forensic examination of handwriting and documents. Currently, the laboratory for forensic examinations of documents and handwriting is equipped with modern optical instruments that enable experts to conduct various examinations of disputed and undisputed material without destroying them. Most of the methods in use are nondestructive and are applied for different purposes, such as forensic examinations of handwriting and signatures, examination of security documents (analysis of security elements, substrates, printing and personalization techniques, etc.), determination of alterations in documents, examination of stamp and stamp impressions, examination of typewritten documents and typewriters, examination of toner and inkjet printed documents and printers, examination of indented impressions, and examination of intersected lines. The majority of those methods are in compliance with the ENFSI1 methods for examination of handwriting (ENFHEX WG2) and documents (EDEWG3) and are accredited according to the ISO 17025 standard. As the interpretation of the findings during the forensic expert examination of handwriting and documents is considered subjective, depending mainly on human perception of the obtained examination results, it is extremely important that handwriting and document experts are well educated and familiar with the latest scientific methods in this field of expertise.

1. Introduction

The beginning of the forensic examination of documents and handwriting dates back to a long time. In ancient Greece and Rome, at the same time as the first use of written official documents, there also appeared to be forgery of official documents and, consequently, the need to determine the authenticity of such documents. For instance, a law promulgated by Emperor Constantine (third century) states that if there is any suspicion as to the authenticity of an official document, a handwriting examination should be performed to prove its authenticity. In the Middle Ages, there were numerous cases of counterfeiting official documents, and draconian penalties were often imposed to prevent this [1].

First, handwriting examination was based solely on comparing grapheme shapes, often leading to incorrect conclusions. In the seventeenth century, Jacques Raveneau, in his book “Discussions on Forged Manuscripts,” stated that analyzing handwriting must not be based only on the shape of graphemes, given that the forms can be easily copied [2].

At the start of the previous century, numerous countries established the first laboratories to conduct not only handwriting examinations but also examinations of stamps and typewriters. This kind of examination became easier with the development and use of instrumental equipment, such as microscopes and stereomicroscopes. Currently, the laboratory for forensic examination of documents and handwriting is currently equipped with modern instruments, such as video-spectral comparators and various stereomicroscopes (equipped with UV and polarized light), an electrostatic detection apparatus (ESDA), and a device for detecting the magnetic properties of inks and toners.

An important contribution to the forensic analysis of documents was made by Albert Sherman Osborn, who wrote a book titled “Questioned Documents” [3], considered today one of the most important works in the forensic examination of documents.

As a rule, the forensic examination of documents and handwriting is performed using nondestructive methods. If further analysis is needed, destructive chemical methods, such as thin-layer chromatography (TLC), high-performance liquid chromatography (HPLC), and gas chromatography along with mass detection (GC-MS), may be used. Conducting destructive methods requires approval from the entity requesting forensic examination, given that the document where the sample is taken for examinations is permanently mechanically destroyed.

2. Forensic examination of handwriting and signatures

The forensic examination of handwriting and signatures determines the origin or writer of the handwriting or signature. The principle behind the examination is based on the fact that every person has unique handwriting, which develops from initial school handwriting to handwriting expressing individualized features [3].

As a scientific discipline, the forensic examination of handwriting should be fully differentiated from that of graphology, which, as a pseudoscientific discipline, determines the writer’s character.

The subject of forensic examination is often various documents, such as last testimonies, attorney power, contracts and certificates, postal delivery notices, anonymous letters and threatening messages, public notarial records, and suicide notes.

Due to the specifics of forensically examined material, nondestructive examination and comparative methods are used for handwriting and signatures to examine the general and particular features, especially stroke details, using a stereomicroscope and comparing the questioned and known material.

The final opinion of the forensic expert depends on the quality and quantity of the delivered material, and to answer the request question, the findings could provide the proposition sets according to, e.g., the ENFHEX scale (weak, moderate, strong, or extremely strong support for one hypothesis over the other hypothesis) [4].

Qualitative examinations and certain identification require quality material used for forensic examinations, which should come in its original form, with clearly designated questioned and known material, time of creation, and a clearly set task for the forensic examination.

Known material should be provided so that the handwriting, contentwise and timewise adapted to the questioned content, is taken from both parties (the suspect and the victim) in the forensic procedure.

In addition to an unusual writing position or writing instrument, the quality of writing can also be affected by the age and health status of the writer, which is evident in various handwriting changes, especially in the fluency and rhythm of writing (Figure 1).

Figure 1.

Examples of handwriting showing distinctly different skills, poorly produced with much hesitation in the pen line and poor line quality (A) and skillfully with a high level of connectivity between letters and good line quality (B). Source: Forensic Science Centre “Ivan Vučetić”.

Consequently, it is important that the forensic expert has that information at hand, which is very often available in court case files.

Handwriting in the elderly population can undergo various degradations and be subject to various changes (Figure 2).

Figure 2.

This shows the rapid deterioration in writing with age and time. Writing (C) was executed at age 93, 2 years after writing (A) and 1 year after writing (B). This illustrates the changes that occur in progressive degradation, such as tremors and loss of control, and a reduction in the size of letters and micrography (C). Source: Forensic Science Centre “Ivan Vučetić”.

Moreover, handwriting discrepancies are expected in the handwriting of people who suffer from various brain traumas, Parkinson’s disease, drug addictions, schizophrenia, various psychological illnesses, and chronic alcoholism (Figure 3) [5].

Figure 3.

Examples of the effect of illness on changes in writing image (A) shows tetraplegia, while image (B) shows multiple sclerosis. The writing samples show many deficiencies in terms of line quality due to hand coordination problems. Both essential tremor and involuntary movements are common for both diseases, but the type of neurological disorder is very unique. Source: Forensic Science Centre “Ivan Vučetić”.

There are also cases that are limited within forensic examination and identification of writers because it is impossible to meet the conditions required for analysis, such as photocopies and/or printouts, given that they cannot undergo basic stereomicroscopic analysis of the strokes.

The finding in such cases can only be expressed as a degree of probability [5].

Accordingly, this also includes cases of exceptionally simple signatures, forms of initials without clearly defined graphemes and elements used for identification purposes, and interesting anonymous letters, in which the writer intentionally distorts the handwriting, concealing his or her identity and writing in a wavy or angular handwriting, resulting in the absence of personal features in the handwriting, which is otherwise essential for identification.

2.1 Biometric/digitally captured signatures

With the development of the digital society, forensic examination of signatures, in addition to traditional examinations of signatures written with a writing medium on a common writing base, has also expanded to the examination of signatures that are digitally captured.

Digitally captured signatures (DCSs) are signatures made by different digital devices, such as a signing pad, tablet, smartphone, or a similar electronic device, together with capturing software (Figure 4).

Figure 4.

Biometric/digitally captured signature. Source: Forensic Science Centre “Ivan Vučetić”.

Such signatures have static characteristics (an image of a signature, size, slant, etc.) and dynamic characteristics (such as speed and pressure, duration, etc.), and both of these characteristics are very important for the examination of DCSs.

Verification of DCSs is possible using DCS analysis software. There is a difference between forensic analysis software, which analyzes, compares, illustrates and determines relevant features of DCSs, and other software, which automatically authenticates newly captured signatures by comparing them to previously stored DCSs stored in a database.

Automatic authentication is not relevant to a forensic examination because it compares only some features and does not consider all relevant characteristics of the signatures. It can only be used as an additional tool and cannot replace experienced FHE [6].

3. Forensic examination of documents

The forensic examination of documents is part of comparative forensic examinations, given that it is based on an analysis and comparison of questioned material and known material.

Forensic experts decide in each particular case on the method to use in the forensic examination procedure, which depends on the type of tested material and the requirements of the requested forensic examination [7, 8, 9].

The material subjected to forensic examination is mostly various types of official documents issued by national or government bodies, such as personal identity cards, driving licenses, passports, diplomas and school certificates, records from births, marriages and deaths registries, and certificates of citizenship.

3.1 Examination of security documents

Given that official documents are deemed security documents, the forensic examination method primarily relies on the method for examination of security documents [10], in which the examination procedure is clearly defined. Examination primarily relates to identifying the authenticity of forms, which includes an analysis of paper and other substrates, identification of printing techniques, security elements (Figure 5), and personalization techniques, including the interpretation and analysis of digital data stored on contactless chips of electronic documents.

Figure 5.

Background security printing in a genuine Croatian passport (A) and an identity card (B). Source: Forensic Science Centre “Ivan Vučetić”.

The comparative material includes samples of known forms relating to security official documents from countries within Europe and the world, archived in the collection of original documents. In case they are not available, forensic experts have international and European databases at their disposal along with descriptions of official security documents.

This method defines the comparative examination procedure for two or more counterfeit documents with the objective of identifying their common origin and analyzing questioned materials and equipment where suspicion exists that it may have been used for producing counterfeit official documents.

3.2 Recognition of printing techniques

Forensic experts conduct further testing to identify the counterfeiting technique by adhering to the procedures defined in the method recognition of printing technique [11] when testing ascertains that the questioned official document is a forgery (Figure 6). This method is applied only in cases where there is a need to identify the technique used to create counterfeit documents and when analyzing the questioned material or equipment for which suspicion exists that it is used in producing the counterfeit document. The forensic expert has reference material at his or her disposal as samples of various techniques used to create documents archived in the collection of sampled techniques for creating documents.

Figure 6.

The microprint on the genuine Croatian identity card (A) was printed in offset, while on the false identity card (B) produced by the inkjet printing, microprint was not reproduced. Source: Forensic Science Centre “Ivan Vučetić”.

3.3 Examination of alterations, NIR absorption/reflection, and luminescence

Questioned official documents and private documents, such as contracts and last testimonies, can be the subject of counterfeiting when the entire or a section of the essential content is altered. In identifying alterations, forensic experts use the examination procedures described in the methods for examination of alterations in documents [12], NIR absorption and reflection [13], and luminescence [14]. Alterations to document content can occur due to mechanical and/or chemical deletion, concealing or altering essential data written manually or by the use of a typewriter or printer (Figure 7). Examples of content alterations are modifications to the text on sales contracts and changes to the validity date on a driver’s license.

Figure 7.

Mechanical and/or chemical deletion of document content. Source: Forensic Science Centre “Ivan Vučetić”.

Upon examination of the questioned document using a near-infrared spectrum, the absorption and reflection properties of the document (substrate, print inks, toners) are determined (Figure 8). Consequently, differences in the absorption, reflection, and luminescence properties of the content or substrate within a document may suggest mechanical or chemical deletion, modifications, the addition of new content, or changes to a part of the document. In particular, some applied forensic examination methods cannot determine whether the traces of chemical substance and/or surface damage to a substrate structure resulted from intentional deletion for counterfeiting purposes or improper handling and carrying of the questioned official document.

Figure 8.

The difference in absorption/reflection properties of different ball point pen inks used for adding text “-xpbat” (A) and for strikethroughing the original text (B). Source: Forensic Science Centre “Ivan Vučetić”.

Sometimes the original, deleted data can be restored, but this depends on the intensity of deletion and the chemical and physical properties of the writing instrument used for writing the original data.

To differentiate inks, such as those used for writing, inks, and toners, from printers and stamp inks, in addition to the abovementioned nondestructive optical methods, FTIR and Raman spectroscopy, such as HPLC-MS and GC/MS, can also be utilized.

3.4 Examination of stamp and stamp impressions

Given that the content of some official documents, such as (school) certificates and diplomas, and the content of certain private documents, such as sales contracts, are certified using stamps, forensic experts are often given the task of determining whether the questioned impressions were created using the original or counterfeit stamp (Figure 9). Examination of questioned stamp impressions, as defined in the examination of stamp and stamp impressions method [15], is conducted using visual and microscopic examination and comparison with equivalent known material.

Figure 9.

Counterfeit border stamp impressions made by freehand drawing. Source: Forensic Science Centre “Ivan Vučetić”.

It is based on determining the similarities and differences in the general and particular characteristics of questioned and known stamp impressions, where such analysis becomes more difficult if the stamp impressions are of poor quality and are sometimes even impossible. This examination required the establishment of collections of original and counterfeit stamp impressions.

3.5 Nondestructive paper examination

Although the production of official security documents increasingly uses synthetic substrates, such as polycarbonates for personal identity cards, driving licenses, and personalized pages in passports, to a large extent, paper is still the material used in the production of official security documents. Determining the authenticity of the paper used in official security documents is done in line with the procedures defined in the nondestructive paper analyses method [16, 17], which includes identifying the security elements in the paper material, such as a watermark, security threads, and security fibers (Figure 10).

Figure 10.

The security paper of the Croatian passport contains a watermark, a security thread with a microprint, and UV reactive security fibers. Source: Forensic Science Centre “Ivan Vučetić”.

This method is also applied in cases to determine whether it comes from two or more unprotected, commercially available papers of the same origin. In that case, certain mechanical and optical properties of the paper are analyzed, such as the grammage, whiteness, absorption, and reflective properties. However, a significant limitation exists in providing a sure opinion on their origin, as commercial mass-produced products are used for mass consumption, whereas modern paper production methods have almost the same chemical composition. Hence, determining the specific origin or source is practically impossible. Nondestructive examination of paper includes mechanical matching of cut or torn paper fragments to determine whether the questioned fragments are part of the (same) sheet of paper and examination of burned (Figure 11) or wet documents [18].

Figure 11.

Fragments of torn and then burned paper containing text. Source: Forensic Science Centre “Ivan Vučetić”.

3.6 Examination of indented impressions

Examination of indented impressions [19] is most often used for examining anonymous or pseudoanonymous letters to find and visualize possible latent indents on the paper to reveal the source of the letters. Such indentations can occur from mechanical pressure (Figure 12), such as a writing instrument or a lever from a typewriter resting onto paper or papers placed on top of the examined paper.

Figure 12.

Examination under oblique light revealed surface irregularities due to differences in the reflection of the incident light. Source: Forensic Science Centre “Ivan Vučetić”.

3.7 Examination of typewritten documents and typewriters

Although printing texts on various documents mostly utilizes different types of printers, often the questioned materials are documents containing text written on a typewriter (Figure 13). Examining unknown typewritten texts tends to reveal the type of typewriter used and its manufacturer [20]. The comparative material used is known samples archived in the reference collection of typescript. Importantly, identifying the manufacturer of the typewriter is often impossible because different typewriters have the same general characteristics, such as the character spacing and shape of the letter and numerical characters. In addition, analysis can be performed to determine whether the questioned text was written on a particular typewriter, whether two or more texts were written using the same typewriter, or whether the questioned document had undergone interpolation of the text using the same or different typewriters.

Figure 13.

The typescript shows the individual characteristics of typewriter used for writing the text of the questioned document (vertical misalignments and defects of some characters). Source: Forensic Science Centre “Ivan Vučetić”.

3.8 Examination of toner and inkjet printed documents and printers

Forensic experts face similar challenges when questioned documents are printed on a printer (Figure 14). Identification of printers in terms of determining the make and model of the printer used to print the questioned text is exceptionally challenging, given that modern printers have similar performances, given that the devices are mass-produced as mass-consumption products [21, 22]. The ink and toners used in such devices exhibit very similar or almost the same physical and chemical properties. In particular, a questioned text(s) can be linked to a specific printer based on the individual characteristics of the printout, such as the disruption of particular letters or specific accumulation of toner particles.

Figure 14.

Differences in print appearance between the laser (A) and inkjet printers (B). Source: Forensic Science Centre “Ivan Vučetić”.

3.9 Examination of intersecting lines

Forensic experts often receive requests to identify the sequence of intersecting lines and answer the question “What was first written?” Examining intersecting lines in documents is an exceptionally demanding area of forensic examination due to the numerous combinations of intersecting systems (e.g., ink-ink or ink-toner), physical and chemical properties of inks and/or toners producing the system of intersecting lines, the substrates on which the intersecting line is found, and other aspects. This method [23] identifies the original sequence of intersecting lines in the system from ballpoint pen ink and dry toner (Figure 15), whereas there is no reliable method for identifying the original sequence of intersecting lines of other systems (e.g., ballpoint pen ink and stamp ink).

Figure 15.

Toner over ballpoint pen ink (A) and vice versa (B). Source: Forensic Science Centre “Ivan Vučetić”.

4. Conclusion

Forensic documents and handwriting examinations include many types of expertise and scientific disciplines and techniques, including human perception and interpretation of findings [24]. The expert provides the court with facts according to his special knowledge, education, and experience from which the judge can then draw conclusions. Therefore, forensic laboratories should recognize the importance of educated and independent experts meeting the system’s accreditation requirements. This means a good knowledge of scientific methods and evidence handling, paper and ink identification methods, printing processes and other research methods, handwriting and signature examination, and court procedures as a court-appointed expert in both forensic fields. The progressive development of new technologies requires attending professional conferences and seminars, educational workshops related to both fields of expertise, meetings, and communication with other colleagues.