Forensic analysis of handwriting and document
FOTO: FSC "Ivan Vučetić"
The forensic examination of documents, as a scientific discipline, is developed at the beginning of the 20th century out of the judicial system’s need to determine the authenticity of documents for evidentiary purposes, through the application of scientific procedures and analytical examinations. It regularly includes the analysis and comparison of a questioned document or one of its parts with a known sample.
The beginnings of forensic document analysis are linked to individual experts, while the first scientific laboratories were not established until the 1930s. Handwriting and document examinations in the former Yugoslavia developed particularly in the period after the Second World War, in parallel with the development of criminalistics techniques. Such examinations have been carried out since the establishment of the former Office for Criminological Investigations in Zagreb in 1953 and continue to this day. In 1998, handwriting and document experts of the Center became full members of two ENFSI working groups: the European Document Experts Working Group (EDEWG) and the European Network of Forensic Handwriting Examiners (ENFHEX).
The forensic analysis of handwriting and documents at the Centre has been carried out for over seventy years. The laboratory today is equipped with the most modern instrumental equipment comprising video spectral comparators, stereomicroscopes and a stereomicroscope equipped with a UV module, a polarized light microscope, an electrostatic detection apparatus (ESDA) for indented impressions, a detection device for magnetic ink and toner properties, and RFID reader.
Besides the forensic analysis of handwriting and documents, the Centre conducted forensic examinations of foreign currency notes and coins from 1995 to early 2009, which later the Croatian National Bank took over.
Forensic examination of handwriting and signatures
The forensic analysis of handwriting and signature determines the origin or writer of the handwriting or signature. Due to the specifics of forensically examined material, non-destructive testing and comparative methods are used for handwriting and signatures to examine the general and particular features, especially stroke details, using a stereomicroscope and comparing the questioned and unquestioned material.
The methods used in handwriting and signature examination are accredited according to the international standard HRN EN ISO/IEC 17025.
As a scientific discipline, the forensic analysis of handwriting should be fully differentiated from graphology which, as a pseudoscientific discipline, determines the writer’s character.
The subject of forensic examination is most often various documents such as last testimonies, power of attorney, contracts and certificates, postal delivery notices, anonymous letters and threatening messages, public notarial records and suicide notes.
The final opinion of the forensic expert depends on the quality and quantity of the delivered material and is given as a decisive opinion or opinion expressing levels of probability (nearly certain, likely, very likely and very likely to almost certain).
For a reliable analysis, all examination material should be provided in its original form and clearly specified in the request for the examination. Copies and/or hard copies of questioned material are not suitable for examination given that they cannot undergo basic stereomicroscopic analysis of the strokes; such material is examined only when originals are unavailable (with the note that in such cases final opinion is expressed as a degree of likelihood). Likewise, the known material must be provided in sufficient quantity to allow the determination of all variations in a person’s handwriting or signature style and must be content-wise and time-wise adapted to the questioned content.
There are also cases in which reliable writer identification is not possible. This includes cases of exceptionally simple signatures, forms of initials without clearly defined graphemes and elements used for identification purposes, as well as interesting anonymous letters and notes, in which the writer intentionally distorts the handwriting concealing his or her identity writes in a wavy or angular handwriting, resulting in the absence of personal features in the handwriting, otherwise essential for identification.
The Centre has at its disposal a collection of anonymous letters as an archive of all anonymous letters after forensic analysis and categorized according to the same writer.
Forensic examination of documents
The questioned material subjected to forensic examination is mostly various types of official documents issued by national or government bodies, such as personal identity cards, driver’s licenses, passports, diplomas and school certificates, records from births, marriages and deaths register, and certificates of citizenship, as well as other types of documents such as tax stamps, security-value labels, bank cheques, payment cards and private documents including contracts, wills, anonymous letters, and others.
Depending on the type of material and the purpose of the examination, the expert determines which of the available examination methods will be applied. As a rule, the forensic analysis of documents and handwriting is done using non-destructive methods. If further analysis is needed, destructive chemical methods may be performed, such as thin-layer chromatography (TLC), high-performance liquid chromatography (HPLC), gas chromatography along with a mass detector (GC-MS) and other methods.
Conducting destructive methods requires approval from the entity requesting forensic examination, given that the document, where the sample is taken for analysis, is permanently mechanically destroyed.
The following non-destructive methods, accredited in accordance with international standard HRN EN ISO/IEC 17025, are applied in document examination:
The method for examination of security documents is used to determine the authenticity of security document forms, classify forged documents, and establish whether seized materials or equipment were used or were intended to be used in the production of forged documents. The comparative material includes samples of known forms relating to security official documents from countries within Europe and the world, archived in the collection of original documents. In case they are not available, forensic experts have at their disposal international and European databases along with descriptions of security official documents. The Center also maintains a collection of forged documents, where relevant forgery samples are stored for the purpose of monitoring document-forgery trends.
The method for recognition of printing techniques is applied in cases when there is a need to identify the technique used to create counterfeit documents and when analyzing the questioned material or equipment for which suspicion exists that it is used in producing the counterfeit document. The forensic expert has reference material at his or her disposal as samples of various techniques used to create documents archived in the collection of sampled techniques for creating documents.
The examination of stamp and stamp impressions method is used to determine the authenticity of questioned stamps and stamp impressions. It is based on determining the similarities and differences in the general and particular characteristics of questioned and known stamp impressions. This examination required establishing collections of original and counterfeit stamp impressions.
The non-destructive paper analysis method is applied when it is necessary to determine the authenticity of security papers, to determine whether papers originate from the same source, or for mechanical matching of cut or torn paper fragments to determine whether the questioned fragments are part of the (same) sheet of paper.
The NIR absorption and reflection method is applied in the examination of the absorption and reflection properties of documents (inks and paper) in the near-infrared (NIR) spectrum, covering wavelengths from 700 nm to 1,000 nm. This method is used for the examination and comparison of inks and paper, and to detect mechanical and/or chemical erasures, alterations, or additions to document content.
The luminescence method is used to examine the luminescent properties of a document (fluorescence and phosphorescence). Luminescence examination is most commonly used for the examination and comparison of paper, security printing inks, writing inks, and for detecting mechanical or chemical erasures, alterations, or added content, as well as certain impressions (such as those found on NCR self-copy paper).
The method for examination of alterations is used to determine whether a document’s content has been altered through mechanical and/or chemical erasure, overwriting, or modification of the original content. Examples include altering a vehicle registration validity date or adding text to a sales contract. In certain cases, it is not possible to determine whether visible traces on a document resulted from intentional erasure of original content or from improper handling or storage of questioned document.
During document examination, experts may also use other methods, such as examination of typewritten documents, examination of indented impressions, and examination of intersecting lines. The examination of typewritten documents is used to determine whether the questioned text was written on a particular typewriter, whether two or more texts were written using the one (same) typewriter, or whether the questioned document has undergone interpolation of the text using the same or different typewriter. The comparative material used to identify the type of the typewriter used and its manufacturer is known samples archived in the reference collection of typescript. The examination of indented impressions is most often used for examining anonymous or pseudo-anonymous letters to find and visualize possible latent indents on the paper to reveal the source of the letters. Such indentations can occur from mechanical pressure, such as a writing instrument or a lever from a typewriter resting onto paper or papers placed on top of the examined paper. The examination of intersecting lines is used to determine the sequence of intersecting lines, but only for intersections between ballpoint-pen ink and dry toner on paper.
One of the common questions directed at handwriting and document experts is whether it is possible to determine the age of a document. Despite numerous studies conducted in recent decades, no reliable methods for determining document age currently exist worldwide. Consequently, the Center does not possess validated methods for determining the age of paper, writing-instrument ink used to produce questioned handwriting or signatures, stamp impressions, or similar features.
List of accredited methods:
The forensic examination of documents, as a scientific discipline, is developed at the beginning of the 20th century out of the judicial system’s need to determine the authenticity of documents for evidentiary purposes, through the application of scientific procedures and analytical examinations. It regularly includes the analysis and comparison of a questioned document or one of its parts with a known sample.
The beginnings of forensic document analysis are linked to individual experts, while the first scientific laboratories were not established until the 1930s. Handwriting and document examinations in the former Yugoslavia developed particularly in the period after the Second World War, in parallel with the development of criminalistics techniques. Such examinations have been carried out since the establishment of the former Office for Criminological Investigations in Zagreb in 1953 and continue to this day. In 1998, handwriting and document experts of the Center became full members of two ENFSI working groups: the European Document Experts Working Group (EDEWG) and the European Network of Forensic Handwriting Examiners (ENFHEX).
The forensic analysis of handwriting and documents at the Centre has been carried out for over seventy years. The laboratory today is equipped with the most modern instrumental equipment comprising video spectral comparators, stereomicroscopes and a stereomicroscope equipped with a UV module, a polarized light microscope, an electrostatic detection apparatus (ESDA) for indented impressions, a detection device for magnetic ink and toner properties, and RFID reader.
Besides the forensic analysis of handwriting and documents, the Centre conducted forensic examinations of foreign currency notes and coins from 1995 to early 2009, which later the Croatian National Bank took over.
Forensic examination of handwriting and signatures
The forensic analysis of handwriting and signature determines the origin or writer of the handwriting or signature. Due to the specifics of forensically examined material, non-destructive testing and comparative methods are used for handwriting and signatures to examine the general and particular features, especially stroke details, using a stereomicroscope and comparing the questioned and unquestioned material.
The methods used in handwriting and signature examination are accredited according to the international standard HRN EN ISO/IEC 17025.
As a scientific discipline, the forensic analysis of handwriting should be fully differentiated from graphology which, as a pseudoscientific discipline, determines the writer’s character.
The subject of forensic examination is most often various documents such as last testimonies, power of attorney, contracts and certificates, postal delivery notices, anonymous letters and threatening messages, public notarial records and suicide notes.
The final opinion of the forensic expert depends on the quality and quantity of the delivered material and is given as a decisive opinion or opinion expressing levels of probability (nearly certain, likely, very likely and very likely to almost certain).
For a reliable analysis, all examination material should be provided in its original form and clearly specified in the request for the examination. Copies and/or hard copies of questioned material are not suitable for examination given that they cannot undergo basic stereomicroscopic analysis of the strokes; such material is examined only when originals are unavailable (with the note that in such cases final opinion is expressed as a degree of likelihood). Likewise, the known material must be provided in sufficient quantity to allow the determination of all variations in a person’s handwriting or signature style and must be content-wise and time-wise adapted to the questioned content.
There are also cases in which reliable writer identification is not possible. This includes cases of exceptionally simple signatures, forms of initials without clearly defined graphemes and elements used for identification purposes, as well as interesting anonymous letters and notes, in which the writer intentionally distorts the handwriting concealing his or her identity writes in a wavy or angular handwriting, resulting in the absence of personal features in the handwriting, otherwise essential for identification.
The Centre has at its disposal a collection of anonymous letters as an archive of all anonymous letters after forensic analysis and categorized according to the same writer.
Forensic examination of documents
The questioned material subjected to forensic examination is mostly various types of official documents issued by national or government bodies, such as personal identity cards, driver’s licenses, passports, diplomas and school certificates, records from births, marriages and deaths register, and certificates of citizenship, as well as other types of documents such as tax stamps, security-value labels, bank cheques, payment cards and private documents including contracts, wills, anonymous letters, and others.
Depending on the type of material and the purpose of the examination, the expert determines which of the available examination methods will be applied. As a rule, the forensic analysis of documents and handwriting is done using non-destructive methods. If further analysis is needed, destructive chemical methods may be performed, such as thin-layer chromatography (TLC), high-performance liquid chromatography (HPLC), gas chromatography along with a mass detector (GC-MS) and other methods.
Conducting destructive methods requires approval from the entity requesting forensic examination, given that the document, where the sample is taken for analysis, is permanently mechanically destroyed.
The following non-destructive methods, accredited in accordance with international standard HRN EN ISO/IEC 17025, are applied in document examination:
The method for examination of security documents is used to determine the authenticity of security document forms, classify forged documents, and establish whether seized materials or equipment were used or were intended to be used in the production of forged documents. The comparative material includes samples of known forms relating to security official documents from countries within Europe and the world, archived in the collection of original documents. In case they are not available, forensic experts have at their disposal international and European databases along with descriptions of security official documents. The Center also maintains a collection of forged documents, where relevant forgery samples are stored for the purpose of monitoring document-forgery trends.
The method for recognition of printing techniques is applied in cases when there is a need to identify the technique used to create counterfeit documents and when analyzing the questioned material or equipment for which suspicion exists that it is used in producing the counterfeit document. The forensic expert has reference material at his or her disposal as samples of various techniques used to create documents archived in the collection of sampled techniques for creating documents.
The examination of stamp and stamp impressions method is used to determine the authenticity of questioned stamps and stamp impressions. It is based on determining the similarities and differences in the general and particular characteristics of questioned and known stamp impressions. This examination required establishing collections of original and counterfeit stamp impressions.
The non-destructive paper analysis method is applied when it is necessary to determine the authenticity of security papers, to determine whether papers originate from the same source, or for mechanical matching of cut or torn paper fragments to determine whether the questioned fragments are part of the (same) sheet of paper.
The NIR absorption and reflection method is applied in the examination of the absorption and reflection properties of documents (inks and paper) in the near-infrared (NIR) spectrum, covering wavelengths from 700 nm to 1,000 nm. This method is used for the examination and comparison of inks and paper, and to detect mechanical and/or chemical erasures, alterations, or additions to document content.
The luminescence method is used to examine the luminescent properties of a document (fluorescence and phosphorescence). Luminescence examination is most commonly used for the examination and comparison of paper, security printing inks, writing inks, and for detecting mechanical or chemical erasures, alterations, or added content, as well as certain impressions (such as those found on NCR self-copy paper).
The method for examination of alterations is used to determine whether a document’s content has been altered through mechanical and/or chemical erasure, overwriting, or modification of the original content. Examples include altering a vehicle registration validity date or adding text to a sales contract. In certain cases, it is not possible to determine whether visible traces on a document resulted from intentional erasure of original content or from improper handling or storage of questioned document.
During document examination, experts may also use other methods, such as examination of typewritten documents, examination of indented impressions, and examination of intersecting lines. The examination of typewritten documents is used to determine whether the questioned text was written on a particular typewriter, whether two or more texts were written using the one (same) typewriter, or whether the questioned document has undergone interpolation of the text using the same or different typewriter. The comparative material used to identify the type of the typewriter used and its manufacturer is known samples archived in the reference collection of typescript. The examination of indented impressions is most often used for examining anonymous or pseudo-anonymous letters to find and visualize possible latent indents on the paper to reveal the source of the letters. Such indentations can occur from mechanical pressure, such as a writing instrument or a lever from a typewriter resting onto paper or papers placed on top of the examined paper. The examination of intersecting lines is used to determine the sequence of intersecting lines, but only for intersections between ballpoint-pen ink and dry toner on paper.
One of the common questions directed at handwriting and document experts is whether it is possible to determine the age of a document. Despite numerous studies conducted in recent decades, no reliable methods for determining document age currently exist worldwide. Consequently, the Center does not possess validated methods for determining the age of paper, writing-instrument ink used to produce questioned handwriting or signatures, stamp impressions, or similar features.
List of accredited methods:
- Examination of security documents
- NIR absorption and reflection
- Luminescence
- Examination of stamp and stamp impressions
- Recognition of printing techniques
- Non-destructive paper analysis
- Examination of alterations
- Handwriting examination and comparison
- Signature examination and comparison