Forensic Document Examination Blog Articles

Acronyms & Terms Used In Forensic Document Examination

Tue, 12 Jul 2022 21:47:07 GMT

Types of File Formats:

Note: hyperlinks listed were accessed August 2020

PDF

Portable Document Format files are not image files. They "capture formatting information… making it possible to send formatted documents and have them appear on the recipient’s monitor or printer as they were intended." PDFs can be created using scanners, printer properties, PDF software, and internal computer software like MS word. Pages are usually created at either 150 ppi or 300 ppi and compressed using algorithms. The process creates a series of artifacts is commonly referred to a pixelation.

https://www.jetpressfl.com/file-preparation/print-file-formats/ , et al.

TIF/TIFF

Tagged Image File Format: "uses lossless compression to maintain image integrity and clarity." In lossless compression, little/no image data is lost during the compression process.

https://www.jetpressfl.com/file-preparation/print-file-formats/ , et al.

JPEG/JPG

Joint Photographic Experts Group: "image file format… uses lossy compression

(lossy meaning “with losses to quality”). JPG data, when compressed, leads to a decrease in image quality if image is enhanced in any way.

https://www.jetpressfl.com/file-preparation/print-file-formats/ , et al.

DPI, PPI, Pixel and Pixelation

DPI

Dots Per Inch: "is a measure of…image scanner dot density, in particular the number of individual dots that can be placed in a line within the span of 1 inch."

https://en.wikipedia.org/wiki/Dots_per_inch

PPI

Pixels Per Inch: "are measurements of the pixel density (resolution) of an electronic image device, such as a computer monitor…, or image digitizing device such as a camera or image scanner. Horizontal and vertical density are usually the same, as most devices have square pixels…" PPIs are closely related to DPIs.

https://en.wikipedia.org/wiki/Pixel_density

Pixel

"Short for Picture Element" ¹ , "a pixel is generally thought of as the smallest single component of a digital image…To represent color images, separate red, green and blue components are used for each pixel, and so the pixel 'value' is a vector of three triad numbers." ² A pixel is "equivalent to roughly 1⁄96 inch (0.26 mm)" ³ .

In Photoshop CC digitized documents are opened in RGB image mode.

Consider pixels like Pointillism, "a neoimpressionist painting technique, from the late 19 ^th century, using tiny dots of various pure colors, which became blended in the viewer's eye. The technique relied on systematic calculation and scientific theory to achiever predetermined visual effects" ⁴ , too.

¹ https://www.webopedia.com/TERM/P/pixel.html

² https://htm.fandom.com/wiki/Pixel

³ https://en.wikipedia.org/wiki/Pixel

⁴ https://www.britannica.com/art/Neo-Impressionism

Pixelation

A noun used to describe "the display of a digitized image such that the pattern of pixels is obvious to the naked eye". ¹ Pixelation is the common term used, which refers to process creates a series of artifacts. Evidence of pixelation/artifacts can be observed using variety of scientific-based techniques. "An image artifact is any feature which appears in an image which is not present in the original imaged object. An image artifact is sometime the result of improper operation of the imager." ²

¹ http://www.kirkmahoney.com/blog/2009/05/pixilation-vs-pixelation/

² https://www.cis.rit.edu/htbooks/mri/chap-11/chap-11.htm

Algorithm, Metadata and Metadata Analysis

Algorithm

"Algorithms resemble recipes. Recipes tell you how to accomplish a task by performing a number of steps… An algorithm is an unambiguous description that makes clear what has to be implemented."

https://fiftyexamples.readthedocs.io/en/latest/algorithms.html#:~:text=However%2C%20%E2%80%9Calgorithm%E2%80%9D%20is%20a%20technical%20term%20with%20a,produce%20the%20correct%20result.%20...%20More%20items..

Metadata

"Metadata is data about data…it's information that's used to describe the data that's contained in something like a…document...Metadata is data that describes data, but it isn't the data itself.

Think of metadata as a card file in your childhood library that contains information about a book; metadata isn't the book itself. You can learn a lot about a book by examining its card file, but you have to open the book to read it."

https://www.lifewire.com/metadata-definition-and-examples-1019177

Metadata Analysis

Using computer software to examine metadata in order to determine essential features found within a document file by separating it into component parts. Determining if a document contains copied and pasted sections/parts is a function of metadata analysis.

Cut-and-Paste (C&P) and Copy-and-Paste (CP)

C&P

Computer commands for 'cut' and 'paste', move text or data or a digital image from one place in an electronic document or computer system to another electronic document or computer system. "…the cut and copy operation is destructive in nature and if not executed properly, could lead to data loss." Can be used as a noun, a verb, or an adjective.

https://www.techopedia.com/definition/6299/cut-and-paste-cp

CP

Computer commands for 'copy' and 'paste', copy text or data or a digital image from one place in an electronic document or computer system to another electronic document or computer system. "Unlike cut and paste,…copy and paste creates a duplicate in the new location." Can be used as a noun, a verb, or an adjective.

https://www.techopedia.com/definition/6299/cut-and-paste-cp

Digital Image, Digital Image Vector File and Raster Files

Digital Image

"Is formed from the pixels and the device used to capture the digital image." A digital camera and a scanner are devices that capture digital images, which are identified by the file format names "… JPEG… TIFF…".

https://www.educba.com/what-is-digital-image/

Digital Image Vector Files

are text data which can be enlarged or reduced without pixelation. “Vector i mages are…created in in Adobe Illustrator” and other programs as well. Vector images are typically saved as…PDF" document file, allowing each image to be as crisp and clear as the original.

https://mariahalthoff.com/blog/raster-vs-vector-files

Digital Image Raster Files

…are images created by pixels. Each pixel is assigned a color…Raster files are typically saved as…JPEG…" ¹ image files. "Advanced raster editors, like GIMP (free) and Adobe Photoshop…are equipped to deal with raster images down to the pixel." ² These editors create layers, which can be flattened. This means the program " condenses all the image layers into one single layer " ³ . After the layer is saved it cannot be reopened with layers.

¹ https://mariahalthoff.com/blog/raster-vs-vector-files , et al.

² https://en.wikipedia.org/wiki/Raster_graphics_editor

³ https://www.techwalla.com/articles/what-does-it-mean-to-flatten-your-photoshop-image

Image Anomalies

"Deviations from the common…arrangement or form" are irregularities and inconsistencies between and among digital images, which may be far removed (generationally speaking) from the original. For example, pixel colors range from barely visible in a PDF made from an original document to varying shades of light to dark gray around areas of interest (AOI) in a (multi-generation) questioned PDF document.

https://www.dictionary.com/browse/anomalies

Computer Software Applications (apps)

Adobe Acrobat Pro DC

"… used to create, edit, manipulate, sign, print, organize, and track PDF files" and export digital images within a PDF file.

https://www.lifewire.com/adobe-acrobat-software-1077212

Adobe Photoshop CC

Forensic document examination industry standard with "one of the most advanced and popular image editors in the world." Screens can be enlarged 12,800%.

https://adobe-photoshop.en.softonic.com/

Affinity Publisher

“…this incredibly smooth, intuitive app gives you the power to combine your images, graphics and text to make…[new] layouts ready for publication.

https://affinity.serif.com/en-us/publisher/

Microsoft Word (MS Word) & PowerPoint Presentation (PPT)

"The most widely used tools for working with documents and presentations". MS Word screens can be enlarged up to 500%; PPT screens up to 400%.

https://microsoft-word.en.softonic.com/

SnagIt

"A comprehensive screen capturing tool…Once captured, your image is stored and ready for editing or sending…file formats as…PDF…and JPG" and TIFF, among others. https://snagit.en.softonic.com/

New Paragraph

General Principles of Forensic Document Examination

Fri, 01 Jul 2022 21:47:10 GMT

Although a person may attest to his/her signature as being authentic, detecting fraudulent documents may involve more than just examining handwriting. Looking for similar/different patterns of watermarks, staple holes, trash marks and other paper document element patterns can identify/eliminate a document as being authentic/not authentic.

Even before the advent of computers and software programs, there were guiding principles requiring examination of fraudulent document elements like staple holes, watermarks, printer defects, a typist’s habits, measurements of various elements and more to detect patterns of alterations.

In today’s world, in addition to gathering evidence about the above document elements, the process of digital image document authentication involves several more tasks. These tasks include, but are not limited to, evaluation of image structure and content (artifacts consistent with image manipulation), metadata analysis, issues of provenance (location where the image was recorded), evidence of staging, and anachronism (appropriate to a period other than that in which it exists).

Procedures and techniques involving digital scanning in TIFF mode and JPG mode, digital microscopy, other magnification modes and analysis techniques I may use include, but are not limited to, Photoshop CC, MS PowerPoint, MS Word, and Affinity Publisher.

Refer to Definitions of Acronyms and Terms Article for other acronyms and terms which may be used in reports or during testimony.

MOST IMPORTANTLY: The techniques and procedures employed in an examination do not attempt to provide any assumption regarding how the manipulation occurred and only provide evidence so opinions may be rendered as to whether or not there are document alterations (i.e., whether or not the document in question is authentic).

General Principles of Forensic Handwriting Examination

Thu, 23 Jun 2022 21:47:12 GMT

In order to determine the authenticity or lack of authenticity of a signature, forensic handwriting examination procedures involve using two evaluations simultaneously. These handwriting examination procedures have been documented and tested, both empirically and experimentally, for over 100 years. The guiding principles require that an examination must search for patterns of characteristics that indicate genuineness, as well as patterns of characteristics that may indicate simulation or disguise.

Natural variation in a person’s writing precludes it from being mechanically precise; therefore, a person’s signatures are never exactly alike.

Individual handwriting characteristics, unique to a particular writer, exist in every person’s handwriting, distinguishing it from every other person’s handwriting.

Handwriting characteristics to be analyzed may include line quality (one of the strongest points of identification in handwriting is the alignment of the writing with the baseline), pressure patterns, rhythm, slant, slope, size and proportions, utilization of space and spatial alignment, initial and terminal strokes, writing speed, legibility, skill level, letterforms, types of connectors, methods of construction, and idiosyncratic characteristics and patterns thereof.

Some handwriting characteristics in Questioned handwriting/signatures may be significantly similar or significantly dissimilar/different to evidence found in comparison handwriting/signatures, while other handwriting characteristics may be only similar or dissimilar/different to evidence found in the comparison handwriting/signatures.

A similarity is a handwriting characteristic in common between two or more handwritten items and may be common among many writers (Ex. how a cursive capital 'A' is written) Influences such as childhood training or a similar style may cause two people to write similarly.

A dissimilarity/difference is a handwriting characteristic not in common between two or more handwritten items of a writer. (Ex. variations in way a capital ‘S’ is written.) A person might write a formally written cursive ‘S’ more carefully written than a printed ‘S’ scrawled on a grocery list.

A significant similarity is an identifying handwriting characteristic in common between two or more handwritten items (Ex. the distinctive style of writing an ampersand) falling within the range of natural variation of the writer.

A significant dissimilarity/difference is a handwriting characteristic that varies between two or more handwritten items and falls outside the range of natural variation of a writer.

Handwriting of Someone with Multiple Personalities

Fri, 17 Jun 2022 19:07:10 GMT

My very first introduction to document examination and handwriting analysis came in the form of a photocopy with all sorts of writing. Our assignment was to find similar handwriting characteristics because there were obvious differences, as you can see.

It turns out this was from the book When Rabbit Howls. It shows the handwritings of many of the 92 individual personalities which inhabited Truddi Chase. This true story of her life was written by her and ‘the Troops’, which was what she called her multiple personalities.

The lesson I learned was significant similarities or significant differences are handwriting characteristics which identify or eliminate someone as the author of a questioned handwritten document or a questioned signature. These significant similarities and/or differences are found by comparing questioned handwriting to handwriting samples and questioned signatures to known signature samples . But you say, “Well, I write just like my mother. So how could you tell which of us wrote something?”

Many people write like someone else; therefore, the writing would be similar, but not significantly similar. For example, many times people who learned to write at the same school, write similarly. When I see my fellow second graders’ writing even today, there are many similarities, even among males and females.

Just remember: No one signs his/her name exactly the same way twice. And no one writes letters, marks and numerals exactly the same way even within the same document. There is variation every time.

That’s why questioned document examiners (aka, forensic document examiners) ask for numerous — the more the better —comparison writings or comparison (exemplar) signatures within a certain timeframe. When you call FFD to discuss your particular case, I will relate how many exemplar documents would be ideal for your case.

Forensic document examiners determine the variations within the known comparison (exemplar) signatures and compare those signatures to a questioned signature to find the evidence needed to identify or eliminate someone as the author of the questioned signature. The same applies to a questioned writing, like the body of a holographic will.