Most Innovative Company, South Africa, 2016, African Business Awards
Best Forensic Investigation Company, Africa, 2016, African Corporate Excellence Awards
Best in Security, Forensics & Investigations – 2016 – International Business Awards
document forensics

Document Forensics

Document forensics, also known as forensic document examination or questioned document forensics, is a forensic discipline that focuses on the examination of handwritten, printed or machine-generated documents whose authorship, authenticity or origin are questioned.

A forensic document examiner makes scientific examinations, comparisons, and analyses of documents for the purpose of:

  1. Establishing the authenticity and provinance of a document
  2. Exposing forgery or revealing additions, deletions or alterations
  3. Identifying or eliminating persons as the source of handwriting
  4. Identifying or eliminating the source of typewriting, impressions, marks
  5. Writing reports or giving testimony, when required

Forged Signatures

Forgeries generally fall into the following categories:

  • No attempt is made by the forger to imitate the genuine signature of the person supposedly signing the document.
  • There is an attempt to imitate the genuine signature by some method of tracing of a model signature.
  • There is a freehand attempt to simulate the genuine signature from a model.
  • The document and the purported signer are fictitious.
  • A “cut & paste” job wherein a genuine signature, or copy thereof, is transferred from some authentic source to a fraudulent document.

Apart from the types of forgeries mentioned, signatures may be disputed even when genuine, for instance if the signature has been disguised by the genuine signatory or written in some illegible manner by the writer for the purpose of later deniability. Occasionally the author of a genuine signature has no memory of signing or is unwilling to accept the signature as genuine.

It is possible for the document examiner to identify a document or signature as a forgery, but it is much less common for the examiner to identify the forger. This is due to the nature of handwriting in that, while the forger is attempting to imitate the writing habit of another person, the forger is, at the same time, suppressing his own writing habit, thereby disguising his own writing.

Indented Writing

Indented writing is an imprint which may be left on the underlying pages when the top sheet of paper is written upon. This impression of the writing is influenced by pen pressure and thickness of the paper.

Indented writing is very useful as a form of connecting evidence, such as tying a robbery note to a writing pad recovered from a suspect.

Classically, indented writing was identified and deciphered by means of low angle oblique light and photography. More recently, an instrument known as an Electrostatic Detection Apparatus, or ESDA, is now used to produce a visual image of the indented writing on transparency film.

This procedure is non-destructive, and rather non-detectable.

Handwriting Comparison

When a sufficient amount of writing from two different people is closely examined, there are always identifiable differences. Comparisons of writing samples take into consideration a wide variety of handwriting characteristics including word and letter spacing, slant or slope, speed, pen position, use of capitalization, embellishments, legibility, use of punctuation, and proportion of letters and other attributes.

Document examiners take into account the various combinations of features present within the writing sample as a whole. In addition, examiners look for features such as hesitations in the natural flow of writing, possible retouching or unnatural tremors. These may indicate that an unnatural writing process (e.g. simulation or disguise) has been employed.

No one writes with machine-like precision every time, and variations are evident in a person’s handwriting even within the same document. For example, if a person writes an entire page of signatures, each one will vary slightly. A trained forensic document examiner can discriminate between natural variations in a writer’s own handwriting and significant differences denoting different writers.

Alterations & Obliterations

Alterations, obliterations and erasures not visible to the human eye can often be detected through use of photography and other imaging devices that utilize ultraviolet and infrared wavelengths of light.

obliterated text

Using radiation filtered at various wavelengths, an imaging instrument such as a video spectral comparator (VSC) can reveal writing that has been added with a different ink, or has been altered or removed by exploiting variations in the way different inks respond to different wavelengths of light.

For example, under certain light sources combined with an infrared filter, a document containing information written in ink that has faded over time may be enhanced or processed to appear darker and therefore more legible.

Forensic Equipment

Frequently, those instructing merely ask whether, for instance, a signature on a document is genuine. However, a signature may well have been written by the individual said to have produced the same but the remainder of the document itself may not be genuine. Consideration of other factors such as whether text has been added to a document, whether there has been alteration to a text, whether a document has had pages substituted, whether the document has been signed in blank, back-dated etc. should always be considered in forensic casework. To this end, the laboratory is equipped with an extensive range of equipment to assist in such matters.


Critical evidence contained in a questioned document is often not visible to the naked eye. Stereo microscopes provide low to moderate magnification and gives the examiner a 3-dimensional view of an area of interest. For higher magnification a binocular microscope equipped with coaxial illumination is used. Microscopy essentially allows an examination of the very fine detail of signatures, handwriting and documents in general

Infrared Techniques

Infrared reflectance and luminescence equipment is available (together with visual luminescence facilities) to distinguish between inks, identify the presence of foreign substances (glues etc) on documents etc. Instant video printout systems (similar to photographs) are also incorporated into the system (black and white and colour), as is a VCR recorder to capture images for later use or to record changing images.


The above equipment is supplemented with the use of a Polylight, a powerful tuneable light source that can be used to promote both visual and infrared luminescence in order to differentiate between inks. The above techniques are routinely used and are wholly non-destructive.

Thin Layer Chromatography

However, on very rare occasions, chemical analysis of inks utilising thin layer chromatography is necessary and can be undertaken but requires the removal of a short section of an ink stroke for analysis, i.e. this is a “destructive” test. This procedure is generally used as a last resort after all other examinations by all parties’ experts and then only with the written permission of the owner of the document in question or on instruction by the Court.

Electronic imaging

The ADV2 instrument facilitates multiple integration of images, enhancing contrast of images, superimposition and nictitation (flicker) comparison of similar images, creation of mirror images etc. Digital photography and computer capture of images is also extensively used.


This technique is applied to virtually all questioned documents submitted to the laboratory. This equipment reveals writing impressions on documents that have been caused by one document having been written upon whilst physically resting on top of the document under examination. The writing process consequently imparts impressions of the writing onto the document below leaving visible indented writing impressions in the underlying paper surface or electrostatic writing impressions invisible to the naked eye which can be highlighted with the ESDA technique. The technique can reveal valuable information relating to the history of documents, the association of documents one with another during preparation, the origin of documents, the presence of tracing guidelines etc and is considered to be an extremely valuable tool in any forensic investigation.

High and low intensity ultraviolet equipment

This is of great value in examining and differentiating between papers, glues, stains and for revealing chemical or physical erasure sites, etc.

Photography/image capture

A variety of conventional cameras, video printers (black/white and colour) and computer scanning facilities are available to capture evidence and if necessary prepare illustrations for court presentation.

Precision measurement

A variety of measuring devices, measuring grids, micrometers, graticules, typewriting grids etc are available where the precision of absolute measurement is imperative. Forensic document examination, or Questioned Documents, is a forensic discipline that encompasses various areas of work relating to the examination of handwritten, printed and other machine-generated documents.

The primary purpose of forensic document examination is to answer questions about a document using a variety of scientific processes and methods. A document examiner answers questions relating to the reliability and authenticity of a document which may involve an examination or comparison of signatures, handwriting, typewriting, printing, indentations and other characteristics of a document. We may be required to determine how or when a document was prepared, whether the document was altered in any way, or to recover information from erased or obliterated portions of the document. Document examiners also compare typewriting or other printed matter and perform ink and paper comparisons.

Intertel’s document forensics capabilities

Accredited and well-respected forensic document examiners can be called upon to make scientific examinations, comparisons, and analyses of documents in order to:

  •   Establish genuineness or non-genuineness, to expose forgery, to reveal alterations, additions or deletions,
  •   identify or eliminate persons as the source of handwriting,
  •   identify or eliminate the source of typewriting or other impressions, marks, or relative evidence, and
  •   write reports or give testimony, when needed.

Forensic document examination includes the examination of:

  •   Comparison of inks, printers, scanners and photocopiers
  •   Handwriting and signatures
  •   Alterations and obliterations to documents
  •   Hand stamps
  •   Reconstruction of torn, shredded, flooded or burnt documents
  •   Relative sequencing of writings and printings
  •   Indented impressions of writing
  •   Developing latent fingerprints