Vol. 6, No.

1, April 2003

FORENSIC DO CUME NT EXAMINATION/Case Study/Document Authenticity: 35-8-01-06-16/0304

DOCUMENT EXAMINATION: INFORMATION
RETRIEVAL IN THE FRAMEWORK OF PHYSICAL AND
TECHNICAL ANALYSIS 1
Methods to assess document authenticity and potential manipulation.
by Franz-Josef Breuer2

REFERENCES: Breuer, F.-J., "Document Examinations: Retrieval in
the Framework of Physical and Technical Analysis," The International
Journal of Forensic Document Examiners, Vol. 6, No. 1, April 2003, pp.
1-8.
ABSTRACT: Document examinations cannot be initiated with the
potential of arriving at categorical results unless the evidence under
examination can be shown to be authentic. In some instances this can be
quickly addressed based on the history of writing materials, presence of
water marks or other manufacturer’s information. In other cases the
information or history of the preparation of the document may not be
readily transparent. In these cases the expert may be required to undertake
sophisticated examination methods to confirm the absence of surreptitious
evidence of tampering. Several case studies are examined for the purposes
of demonstrating the presence of alterations which might be considered to
affect document authenticity.
1. EXAMINATION OBJECTIVE AND SAMPLES
Examination objectives were the definition of terms with relevant
case studies as well as the frequency distribution of the various forms
of manipulation of supporting documents / receipts.
A sample of 80 proceedings (a total of 231 supporting documents)
including hand-written application samples from the regional branch
of German insurance company, which were submitted for the
adjustment of damages during a period of 6 months, formed the basis
for the examination.
The sample is presented as follows (Table 1):
Table 1.
Type of Damage Proceedings Supporting Documents

KEYWORDS: ESDA, authenticity, indentations. Liability Claims 26 31

INTRODUCTIONS Break-ins 47 185

The questions that arise in the expert field of handwriting analysis and Water 3 5
document examination are clearly formulated, or they result from the
relevant files (for instance questions regarding the authenticity and/or the Storm 2 3
authorship or longitudinal analysis). However, when commissioned with
the examination of supporting documents or receipts, the common Fire 2 7
question is:
Total 80 231
“Is this an authentic document?”.

Commissions are modified regularly so that examination is often

restricted as to whether any manipulation of the document has taken place. On the basis of the above data, the distribution relating to
The objectives are, above all, findings regarding any traces which may proceedings is shown in Figure 1.
provide information on relevant modifications, anachronisms or suspicious
characteristics.
In order to answer questions concerning the examination, a 2. IDENTIFICATION OF TERMINOLOGY AND CASE
preliminary inspection of the document is carried out prior to the STUDIES
examination phase and the plausibility of the document’s content is
checked [1], above all with regard to any possible anachronisms. The following categories were chosen for a differentiated
Generally, non-destructive standard methods of physical and technical evaluation of the supporting documents received and for the
document analysis are still employed (in accordance with guideline 1.0 of clarification of the statements made:
the GfS).
In some cases, the results of these investigative-technical examinations Anachronisms:
lead to further inquiries on the part of the commissioner as to a more
detailed elaboration on the evaluation or clarity of the statements made. The statements made are clear; findings reveal inconsistency with the
Reasons for a more in-depth experimental examination were, on the document’s date. From an expert point of view, they alone constitute
one hand, problems of understanding concerning verbal statements made assessed evidence.
during the investigative-technical procedure, and on the other hand,
questions concerning the different types of manipulation of supporting Manipulations:
documents or receipts.
The document examination proves modifications; findings leave no
1
V. International Congress of the GFS Bingen/Rhein, June 13-16, 2001 doubt that the supporting documents have been manipulated.
2
Pagenhau 28, D-52382 Oberzier, Germany. Email FJBreuer@t-online.de

Copyright © 2003 Shunderson Communication, Inc. All Rights of Reproduction Reserved 1

The International Journal of Forensic Document Examiners

Figure 1: Distribution by type/cause of damage.

Figure 2: Comparison of date and date relief print.

Special characteristics: Anachronisms

The findings or observations made indicate a manipulation at the least.
However, further connecting facts are required for a final evaluation.
Indications:
Further examination possibilities, that are not within the responsibilities
of the expert, have resulted during the general examination. These are
transmitted to the commissioner in form of suggestions.
The categories anachronisms, manipulations and characteristics are to
be illustrated with two relevant examples, whereby the examination
method which led to the relevant findings is to be named:
Case Study 1:
A receipt for 349,- DM; dating from 05.05.2000 was to be examined.
With the help of electrostatic surface detection (ESD), assessments
were to be made as to whether identifiable impression marks could be
made visible, indicating the actual document date. Such relief prints occur
if another paper is placed underneath the document at the time of writing
(with or without intention).
Apart from impression marks of the receipt amount and details as to
where the receipt was drawn out, a relief print was made visible showing
the date 17.08.2000, equally positioned to the space boxes of the form
(Figure 2).
Particularly in the case of forms from books or pads, it is generally to

2 Copyright © 2003 Shunderson Communications, Inc. All Rights of Reproduction Reserved


be expected that only impression marks of older dates or the same date can
be made visible, provided they are written in an equal position to that
intended in the form.
In this case, the impression mark of a more recent date was revealed
(17.08.2000), equally positioned to the box of the receipt dating from
05.05.2000.
This statement is to be considered as an anachronism.
Case Study 2:
An invoice over 2.899,-DM dating from 17.04.1998 was submitted for
examination.
A form of the company Zweckform was used as a subject document,
which, according to the manufacturer, is only printed with the new box
“Währung z.B EUR” (Currency, eg. EURO) since July 1998 (Figure 3).
Due to the fact that the form had only been modified in July 1998,
it is without doubt that the form with the filled in date of 17.04.98 had
not been available at that time. For the sake of completeness, it is to be
mentioned that the amount and currency details were overwritten and that
no relevant statements could be made (only the amount details are pictured
above - Figure 3).
Manipulations
Case Study 3:
A compensation claim was made with two receipts, which, to a large
extent, were drafted in Arabic. It was further reported that the receipts
were drawn up by a jeweler in Essen on 15.07.1993 (No. 4649) and on
Figure 3: Relevant or anachronistic field in the form.
Copyright © 2003 Shunderson Communication, Inc. All Rights of Reproduction Reserved
Vol. 6, No.1, April 2003
08.09.1996 (No. 4650).
As a result of the fact that a consecutive receipt number of a period
exceeding three years is not very plausible, and that electrostatic detection
revealed no applicable impression marks, the perforation lines taken under
examination (Figure 4).
Using video techniques it was also possible to state and document that,
taking the signs of wear into account, the perforation lines of both receipts
are identical. In addition, the receipt numbers are equally positioned.
Due to the fact that the perforation lines are identical, and the
receipt numbers positioned equally, it is clear that both invoices were
drafted on forms from one single book. This contradicts the dates filled
in of 1993 and 1996.
Furthermore, details regarding the date were confirmed by the
translation. With regard to the issuer, the telephone dialing codes point to
Egypt, Saudi Arabia and Yemen
In this case, it can definitely be discussed whether or not the
statements made are to be classified within the category “Anachronisms”.
Case Study 4:
In this case, an invoice over 990,-DM dated 24.09.1998 was used for
a compensation claim.
A form of the company sigel was used – however, an enquiry
regarding the print positioning was not made due to the clarity of the
findings illustrated below.
It was obvious that the digits indicating the year, as well as the
invoice amount were modified with biros using different ink. The primary
entries “24.09.92” and “790,-“ were changed to “98” and “990,-“.
Scanning techniques clearly confirmed this with regard to the year (Figure
5).
3
The International Journal of Forensic Document Examiners

Figure 4: Comparison of perforation lines of the consecutive receipts.

Figure 5: Illustration of the relevant written entries and modifications.

4 Copyright © 2003 Shunderson Communications, Inc. All Rights of Reproduction Reserved

 Vol. 6, No.1, April 2003

Due to the evident secondary printing it is clear that the invoice of
700,-DM dating originally from 1992 was modified by overwriting.
To complete things, it should also be mentioned that the entered VAT
rate of 14% was only valid until 31.12.1992 – on 24.09.1998 the rate was
16%, and from 01.01.1993 to 31.03.1998 the tax rate was 15%. It is not
very likely that a businessman should enter a VAT rate in 1998 which had
not been valid for five years.
Special Characteristics
Case Study 5:
An invoice over 13.980,- DM was submittels as proof of purchase.
The subject document, prints with Arabic lettering, dated from
15.12.1999.
Standard methods of physical and technical document examination
lead to no findings which would have permitted a clear statement
confirming manipulation.
Nevertheless, statements could be made which do exclude an orderly
and regular drafting of the document.
Apart from the differing relief prints, ESDA also revealed slightly
shifted impression marks of parts of an identical print in the negative relief
print of the document, as well in the product and amount details (Figure
6 and Figure 7).
When summing up the results, it was concluded that there is a lot of
doubt as to whether the invoice had been drawn up correctly in one go. In
addition, it was indicated that, according to the translation, the document
was drafted in Irbed/Jordan, and not, as claimed, in Germany. The
document would not have complied with German accounting standards.

Figure 6: The different relief prints of the written entries.

Copyright © 2003 Shunderson Communication, Inc. All Rights of Reproduction Reserved 5

The International Journal of Forensic Document Examiners
Figure 7: Foreign identical relief prints on the suspect document.
Case Study 6:
After the occurrence of damages, an insurance application was
presented which was more favorable for the insured party. It was presumed
that the document had been drafted subsequently.
The document examination did not lead to any clues that would have
confirmed this presumption.
However, suspicious characteristics were perceived concerning the
signature under examination. The signature clearly differs from a signature
sample which had been made shortly before in a notification of loss with
regard to its graphic impressions, authorship, unity and fluency (Figure 8).
Furthermore, discrepancies were analyzed within the field of motorial
co-ordination (line quality, print pressure and motion) that can not be
justified even under the presence special circumstances when signing.
The following picture (Figure 9) shows the specific features of the
suspect signature of the insured party on the left, and on the right, the
respective comparisons with the signature sample.
A comparative signature analysis was not possible in this case due to
the lack of extensive signature samples as well as insufficient information.
Nevertheless, clear doubts were expressed concerning the suspect
signature.
INDICATIONS
Whereas in the three before-mentioned classification categories
statements can be made that ensue from the general document
examination, in the case of an indication, only further examination
possibilities can be referred to. Such references can be in the form of
observations made concerning specific features of the mode in which
documents are drafted, accounting audits in the case of non-cash
payments, or requests for further documentation in the case of private
purchases (e.g. Original invoice, guarantee documents, etc.).In this
context, further examination methods can be illustrated that are not
possible given
6 Copyright © 2003 Shunderson Communications, Inc. All Rights of Reproduction Reserved
the documentation provided, or that fall into a different field of research.
3. FREQUENCY DISTRIBUTION
Taking the before-mentioned classifications and terms as a basis,
following statements can be shown graphically in Figure 10.
These results were reported either in the form of expert evidence in
cases of anachronisms and manipulations, or in the form of reports in cases
of special characteristics, or returns, if no findings were made or no
indications provided.
This leads to the following distribution shown in Figure 11.
4. SUMMARY
The analysis of a sample of 231 supporting documents has, in my
opinion, shown that by listing the results in the categories anachronisms,
manipulations, special characteristics and indications, the terminology
used can also be understood by the non-expert reader.
By further differentiating the written contributions as expert evidence
or reports, depending on the examination result, the evaluation of findings
should appear clearly formulated.
Moreover, this experimental analysis, which can and should not be
seen as representative, has shown that a wide range of examination
methods exists for the analysis of supporting documents with hand-written
elements.
After all, the percentage of anachronisms and manipulations did
account for 20%.
BIBLIOGRAPHY
[1]. Michel L. (1982): Gerichtliche Schriftvergleichung. Berlin: de
Gruyter: 153
 Vol. 6, No.1, April 2003

Figure 8: Comparison of the suspect signature (top) and the signature sample (below).

Figure 9: Discrepancies in the motorial co-ordination.

Copyright © 2003 Shunderson Communication, Inc. All Rights of Reproduction Reserved 7

The International Journal of Forensic Document Examiners

Figure 10: Graphic representation of the results.

Figure 11: Distribution of results.

8 Copyright © 2003 Shunderson Communications, Inc. All Rights of Reproduction Reserved