Examen De Documentos

566 DOCUMENT ANALYSIS/Analytical Methods

DOCUMENT ANALYSIS Contents

Analytical Methods Document Dating Forgery/Counterfeits Handwriting Ink Analysis

Analytical Methods V Aginsky, Riley, Welsh and Associates, Forensic Document Examinations, Inc., East Lansing, MI, USA Copyright # 2000 Academic Press doi:10.1006/rwfs.2000.0477

technique is also used for paper fiber analysis that allows the type of fibrous raw materials used for making the paper of Q documents to be determined. Scanning electron microscopy is used when a highly magnified image (down to the nanometer range) of a micro-fragment of ink on paper or of paper itself is desired, for example, in cases when the sequence of crossing strokes is under examination.

Introduction Tasks often requested for the analysis of documents involve distinguishing inks on the same or different documents and also identifying the source or date of a particular ink or paper. Usually these types of determinations are conducted with the help of analytical methods. There are many such methods available and the document examiner should know their capabilities and limitations.

Optical Examinations Practically each examination of a questioned (Q) document starts with simple optical methods which allow observations in ultraviolet (UV), visible (natural daylight, filtered or unfiltered artificial light) or near infrared (IR) regions of the electromagnetic spectrum. These methods analyze color and luminescence of ink on paper, security fibers in paper, etc. They may also help in viewing obliterated writings, exposing alterations, erasures and substitutions, and discriminating between writing inks that appear to be of the same color. The morphology of ink lines on paper is examined with the help of optical microscopy that uses visible light for illumination, and glass lenses for magnifying and focusing. This may allow classification of inks being examined, discrimination between inks being compared, or may, in rare occasions, individualize the writing instrument through its performance characteristics. In combination with spot color tests, this

Chemical Reactions Spot chemical (color or crystal) tests are known to have been used for more than a hundred years for detecting both inorganic and organic ingredients of inks and paper. The spot or solubility tests are carried out both in situ (on the document itself) or on a removed sample. These tests are used to differentiate ink formulas, to presumptively identify the constituents of an ink formula, or to select a solvent suitable for the following extraction of the ink. Spot color and solubility tests have been used for determining the sequence of crossing strokes of different inks and for evaluating the relative age of inks of the same formula and on the same paper.

Spectroscopic Techniques Spectroscopic methods measure the absorption, emission, or scattering of electromagnetic radiation by atoms or molecules of compounds. The resulting spectra of the absorption, emission, or scattering of light are functions of wavelength and depend on the energy level structure of atoms or molecules. These spectra are useful for characterizing and identifying (e.g. with infrared spectra) compounds. X-ray fluorescence is commonly used for solids in which secondary X-ray emission is generated by excitation of a sample with X-rays. The technique has found extensive applications in determining the

DOCUMENT ANALYSIS/Analytical Methods

elemental profile of the ink and paper of suspect currency. This profile is then compared with the profile of genuine currency to uncover inconsistencies. Energy dispersive X-ray microanalysis combined with scanning electron microscopy (SEM-EDX) is an important analytical method due to its ability to examine surface morphology with high resolution and depth of field, and to produce qualitative and quantitative elemental analyses of selected microareas by detection of characteristic X-rays. Many writing and printing inks contain detectable elements that can be used for characterization and comparison by SEMEDX. In addition some writing inks have detectable trace rare organometallic compounds added which indicate the year of its production. Finally, the technique is a useful tool for the classification and differentiation of photocopier toners. In particular, it is useful in recognizing monocomponent process toners as they contain magnetic carrier materials (magnetite, ferrite) which are easily detected by SEM-EDX. SEM-EDX has also been applied to the characterization of trace elemental profiles of pencils. The SEM-EDX analysis of both plain and coated photocopy paper has been used to provide a comparison, detect batch differences or to ensure that the contents of the minor inorganic components detected in the ink or toner samples cut out of the document, are not the result of their contact with the paper. Other analytical methods that also have been used for determining the elemental composition of ink and paper are inductively coupled plasma mass spectrometry (ICP-MS) and neutron activation analysis (NAA). Ultraviolet and visible absorption spectroscopy is used mostly for the analysis of organic materials. It measures the wavelength and intensity of absorption of near-ultraviolet and visible light by a sample. UV±visible reflectance microspectrophotometry has been applied to measuring reflectance (absorbance) electronic spectra of ink on paper. The method allows discrimination between similarly colored inks at a considerably higher degree of certainty than it could be done using optical microscopy or evaluation by the unaided eye. Microspectrofluorimetry has been used for measuring the emission spectra of ink on paper and of some additives to paper (fluorescent fibers, optical brighteners). Infrared spectroscopy measures the wavelength and intensity of the absorption of mid-infrared light by a sample. As the wavelengths of IR absorption bands are characteristic of specific types of chemical bonds, IR spectroscopy can be used to identify compounds. It should be stressed, however, that, if the components of interest are analyzed without isolating from the matrices, their chemical identification is

567

practically impossible; as a rule, only characterization of the major functional groups of the compound can be accomplished. In order to produce conclusive identification, either peak-to-peak correlation using the spectrum of a known sample or a comprehensive software library of IR spectra would be required. Fourier transform infrared (FT-IR) spectroscopy has been used for the characterization of organic components in many materials commonly examined during document analysis (ink, paper, photocopier toners, correcting fluids, etc.). Diffuse reflectance infrared Fourier transform spectroscopy (DRIFTS) has been found to be a reliable, reproducible and selective technique for the classification and identification of photocopier toners. Compared with conventional dispersive IR spectroscopy, the DRIFTS technique provides spectra with a significantly improved signal-to-noise ratio, and therefore, it more effectively extracts data from toners that are normally highly absorbing in the infrared due to the large proportion of carbon black content. Recently, FT-IR microspectrophotometry (a microscope attachment allows the infrared beam to be focused on an extremely small area) has been extensively used for the characterization and differentiation of writing inks and photocopier toners. IR spectroscopy can also be used for document analysis in combination with other techniques. Thus, ink resin can undergo pyrolysis (see below), followed by IR analysis of the volatile gases generated. In most cases, spectra of the pyrolysis products resemble those of the parent substances. Even when they do not, the spectra are fairly reproducible; thus the reference spectrum of a known substance prepared in the same manner can be used for comparison with the material (ink, toner, paper) analyzed. Raman spectroscopy (an emission technique in which a laser is directed onto the sample and a very small fraction of the scattered radiation displaced from the laser wavenumber by the vibrational wavenumbers of the sample, is measured) is used for the analysis of inks and photocopying toners in a manner similar to IR spectroscopy.

Chromatographic Techniques Chromatography is a method used to separate, characterize and identify (e.g. with mass spectrometry) the components of a mixture. Since its introduction in 1903 chromatography has become a separation method that is now a widely accepted and recognized technique. In document analysis, chromatographic techniques are extensively used for the characterization, comparison, source determination and dating of ink.

568 DOCUMENT ANALYSIS/Analytical Methods Paper chromatography

In paper chromatography the mixture to be separated is allowed to soak along the paper by capillary action; the cellulose in the paper acts as the adsorbent. The technique, as well as paper electrophoresis, has been used for differentiating ink samples. Thin-layer chromatography (TLC)

This is a form of liquid chromatography that is used for separating nonvolatile organic and inorganic compounds. Among other analytical techniques applied to document analysis, TLC has been most extensively used both for discriminating inks and for identifying ink formulas (by comparison with a `complete' set of standards, see below). A typical procedure for the TLC analysis of ink is as follows. A sample of ink dissolved in an appropriate solvent, is deposited as a spot (or a band) on the starting line of a TLC plate that consists of a stationary phase immobilized on a glass, aluminum or plastic plate. The constituents of the sample can be identified by simultaneously running standards with the unknown. The bottom edge of the plate is placed in a reservoir with a solvent (mobile liquid phase); the solvent moves up the plate by capillary action. When the solvent front reaches a certain height (e.g. the other edge of the stationary phase), the plate is removed from the solvent reservoir. Inks are mixtures of many components, which move up the plate at different rates due to differences in their partitioning behavior between the mobile liquid phase and the stationary phase. Most separated components of inks are easily detected on the resulting chromatogram due to their own color. The other separated spots (colorless vehicle components) can be visualized with UV light or by treating the plate with an appropriate chromogenic or fluorogenic reagent. Besides the characterization and differentiation of writing ink and the chemical identification of dyes removed from currency involved in a robbery and exposed to an exploding dye-pack, both conventional TLC and high performance thin-layer chromatography (HPTLC) have been applied to discriminating between stamp pad and typewriter ribbon inks, printing inks (including those used in counterfeit currency), photocopier toners containing dyes mixed with the carbon black pigment, jet printer inks and papers (tinting materials, optical brighteners, sizers and other components of paper can be separated and used to discriminate between paper samples). The method has been used both in its normal phase (hydrophilic stationary phase, e.g. silica gel) and reversed phase (hydrophobic stationary phase, e.g. RP-18 modified silica gel) versions, including gradi-

ent elution of ink samples by automated multiple development. Postchromatographic derivatization has been used for the visualization of separated chromatographic zones of colorless organic components of inks and paper. Scanning TLC densitometry has shown a high discriminating power with regard to inks that are indistinguishable to the eye having subtle differences in relative proportions of their dye components. For over the past twenty years, different approaches using TLC have been used for determining the age of ink on documents. According to a so-called `static' approach that deals with the analytical profiles of inks that do not change with age, the examiner determines the age or source of inks by using a collection of reference standards or by detecting tags, e.g. optical brighteners or other unique components specially added by the manufacturer. If the manufacturer of the ink analyzed is identified and its formula is shown to be unique (through a tag or unique formula known only by the manufacturer), the manufacturer's files are consulted to determine the initial production date of the ink. This allows one to establish whether a Q ink was available or not at the time the document was allegedly prepared. One obvious limitation here is that only a few inks actually contain unique dating tags. Another ink dating approach measures the `dynamic' characteristics of an aging ink, i.e. those that change with age. Several ink-dating techniques based on TLC, evaluate the age (date) of a Q entry relative to reference samples which are known dated entries written by ink of the same formula as the Q entry. These techniques primarily use TLC to identify a Q ink formula. However, it should be emphasized that, in fact, unless one is certain that the formula is proven to be unique (see above), the identification of the Q ink formulation with 100% certainty is hardly possible. The reason for this is that, on the one hand, inks of the same type and of similar color are very similar in their dye components (separated and detected by TLC) and, on the other hand, no matter how comprehensive the collection of reference samples is, it will never be complete. Hence, it follows that unless the formula is unique, there is always a possibility that a true match is not in the standard ink library. This circumstance is of extreme importance and it should always be kept in mind when the examiner uses any ink dating technique that is based on the ink formula identification approach. High performance liquid chromatography (HPLC)

HPLC is a form of liquid chromatography in which the stationary phase is packed in a separation column.

DOCUMENT ANALYSIS/Analytical Methods

Components of a sample to be analyzed are separated by injecting a plug of the sample onto the column. These components pass through the column at different rates due to differences in their partitioning behavior between the mobile liquid phase and the stationary phase. The presence of analytes in the column effluent is detected by measuring a change in refractive index, UV±visible absorption at a set wavelength, fluorescence after excitation with a suitable wavelength, or electrochemical response. The separated analytes can also be identified with the help of a mass spectrometric detector. HPLC has successfully been applied to the characterization and differentiation of ballpoint inks. It enables a high discrimination between inks having similar dye composition by separating and comparing their colorless components such as the ink vehicle components which are reliably detected in the UV region of the electromagnetic spectrum. If inks that are to be compared are on different papers, samples taken from the papers should be analyzed by the same procedure used for the ink-on-paper to ensure that sizers, optical brighteners, tinting materials and other chemicals that may present in the paper would not interfere with the analysis. The modern HPLC provides the examiner with a highly sensitive multiwavelength detection system (diode array detector) which will provide not only chromatographic profiles of the inks being compared but also the in-situ recorded UV and visible spectra of each eluting peak in the chromatogram. Obviously, such a combination of chromatographic and spectral data improves the ability of HPLC to discriminate between closely related inks. The ability of HPLC to discriminate between similar ink samples is also enhanced by increasing the resolving power with gradient elution. HPLC has also been used for the analysis of nonballpoint pen inks, as well as printing inks (including those used in counterfeit currency), photocopier toners and paper. Capillary electrophoresis (CE)

Performing electrophoresis in small-diameter capillaries allows the use of high electric fields resulting in very efficient separations. Due to electroosmotic flow, all sample components migrate in pH buffer towards the negative electrode. A small volume of sample (a few nanoliters) is injected at the positive end of the capillary and the separated components are detected near the negative end of the capillary. CE detection is similar to detection in HPLC, and includes absorbance, fluorescence, electrochemical and mass spectrometry. Two versions of CE known to have been used for

569

ink and paper analysis are capillary zone electrophoresis (CZE) and micellar electrokinetic capillary electrochromatography (MECC). In CZE separation is solely based on charge, but MECC enables separation of both charged and neutral or even hydrophobic molecules; it becomes possible by adding organic solvents and surfactants to the pH buffers. CE has recently been applied to the analysis of ballpoint, roller ball, fineliner and marker pen inks, and has shown a very high resolving power that allows the efficient separation of both major and minor components of ink dyes (including their substitution derivatives and isomers) and, therefore, the discrimination between inks with similar dyes from different sources or different batches. The amount of ink-on-paper needed for the analysis is comparable to HPLC and TLC. To detect peaks on the ink electrophoregram caused by the paper's constituents (optical brighteners, etc.), blank paper samples of similar size as those taken from the inked paper should also be analyzed. Gas chromatography/mass spectrometry (GC/MS)

Gas chromatography (GC) is the most widely used analytical technique in forensic laboratories. The technique primarily involves the use of three components: an injector, a separation column (in a thermostated oven) and a detector. After vaporization in the heated injector, the sample is then transferred to the column through the use of a carrier gas. The individual sample components mix with the gas, travel through the column and are selectively retained by the stationary liquid phase contained within the column. Finally, a detector is utilized to produce a signal to a recording device. The resulting gas chromatogram is a series of peaks, each of which is characteristic of a particular substance. It has been shown that the most selective GC determination of components of the complex mixtures can be achieved by the coupling of a micromass-spectrometer (mass selective detector) and capillary GC. Mass selective detector uses the difference in mass-to-charge ratio of ionized molecules to separate them from each other. Molecules have distinctive fragmentation patterns that provide structural information usually sufficient for identifying substances separated by GC. Thus, gas chromatography/mass spectrometry (GC/MS) produces a mass spectral fingerprint for each sample component eluting from the column and, therefore, can allow discrimination between compounds having a very similar chromatographic behavior (close retention indices). GC/MS has been used for the ink characterization,

570 DOCUMENT ANALYSIS/Document Dating

batch origin determination and ink comparison. In the scan acquisition mode, the method allows identification of an ink's volatile solid ingredients among which can be nonreacted low molecular mono- or oligomers, reagents and also proprietary additives that are often contained in the resins, polymers or other components of ink vehicles (carriers). It has been shown that, even in old ink-on-paper, high boiling vehicle solvents can be detected and identified using the selected ion monitoring (SIM) acquisition mode; the detector is set to monitor ions specific to the solvents commonly used in the manufacture of inks. Recently, the unique ability of GC/MS to efficiently separate ink volatile components and to quantify them at down to picogram level has been successfully used for developing ink dating techniques applicable to ballpoint, porous tip and roller pen inks, stamp pad inks, inks for jet printers, and other inks containing high-boiling vehicles. Pyrolysis gas chromatography

GC is capable of separating volatile organic substances. Therefore, it is not directly applicable to the analysis of such nonvolatile substances as resins in inks or sizing materials in paper. However, pyrolysis of similar nonvolatile substances leads to their breakdown (thermal decomposition) into smaller compounds which are volatile enough to be analyzed by GC. A pyrolysis device is directly connected to the inlet of the gas chromatograph and the compounds produced by pyrolysis are separated and detected by the chromatographic system. The resulting pyrogram is a highly specific pattern of peaks which is a `fingerprint' of the substance analyzed. Pyrolysis GC with mass spectrometric detection (PyGC/MS) has been used for the characterization of nonvolatile organic components in inks and photocopier toners. The technique has provided high discrimination between closely related inks and toners. See also: Analytical Techniques: Separation Techniques; Microscopy; Spectroscopy: Basic Principles; Presumptive Chemical Tests; Mass Spectrometry. Document Analysis: Forgery/Counterfeits; Ink Analysis; Document Dating.

Further Reading Aginsky VN (1996) Dating and characterizing writing, stamp pad and jet printer inks by gas chromatography/ mass spectrometry. International Journal of Forensic Document Examiners 2:103±115. Brunelle RL and Reed RW (1984) Forensic Examination of Ink and Paper. Springfield: Charles C Thomas. Cantu AA (1995) A sketch of analytical methods for

document dating. Part I. The static approach: determining age independent analytical profiles. International Journal of Forensic Document Examiners 1:40±51. Kirchner JG (1978) Thin Layer Chromatography, 2nd edn. New York: Wiley Interscience. Lyter AH (1983) Analysis of writing inks by high performance liquid chromatography. In: Lurie IS and Wittwer JD (eds) High Performance Liquid Chromatography in Forensic Chemistry. New York: Marcel Deker. Maehly A and Stromburg L (1981) Chemical Criminalistics. New York: Springer-Verlag. Merrill RA, Bartick EG and Mazzella WD (1996) Studies of techniques for analysis of photocopy toners by IR. Journal of Forensic Sciences 41:81±88. ASTM (1992) Standard guide for test methods for forensic writing ink comparison. 1992 Annual Book of ASTM Standards, Section 13, ASTM Designation: E 1422-91 Philadelphia: ASTM. Tebbett IR (1991) Chromatographic analysis of inks for forensic science applications. Forensic Science Review 3:72±82. Tebbett I (1992) Gas Chromatography. New York, London, Toronto, Sydney, Tokyo, Singapore: Ellis Horwood. Xu X, de Koeijer JA, de Moel JJM and Logtenberg H (1997) Ink analysis for forensic science application by micellar electrokinetic capillary chromatography with photodiode array detection. International Journal of Forensic Document Examiners 3:240±260. Zeichner A, Levin N, Klein A and Novoselsky Y (1988) Transmission and reflectance microspectrophotometry of inks. Journal of Forensic Sciences 33:1171±1184.

Document Dating D C Purdy, Forensic Document Examination Services Inc., Ottawa, Canada Copyright # 2000 Academic Press doi:10.1006/rwfs.2000.0483

Overview The misrepresentation of dates on documents is not a recent challenge faced by forensic document examiners. In his book, Questioned Documents, Albert S. Osborn provided several examples of documents which were altered or backdated to make it appear as though they were written much earlier. Many frauds still involve document dating problems and forensic document examiners should diligently search for any clues that suggest a document was prepared some time other than indicated.

DOCUMENT ANALYSIS/Document Dating

Various methods can be employed to backdate or fabricate documents. Such incidents can involve the relatively simple process of overwriting the date on a receipt to far more complex undertakings such as falsifying an entire document. Regardless of the method used, dating suspect documents is a very challenging problem for the document examiner and should be approached cautiously. The most straightforward method for solving a dating problem considers the types of office equipment and technologies used to produce the questioned document. The date on a document can be proven false if the instruments and materials used to produce it were unavailable when it was supposedly prepared. A second method takes into account certain features in the contested document that vary over time. Defective letters produced by a worn typewriter or photocopier `trash marks' originating from dirt on the platen glass are two examples of this type of evidence that has dating significance. A third method involves the analysis of materials that make up a suspect document. For example, some speciality papers or writing inks contain materials added to these stationery products to improve their quality. If it can be established that these materials were introduced to the market on a specific date, any document in which they are found to be present must have been prepared at a later time. A fourth method involves knowledge of the aging of several components such as ink or paper. The following sections describe different areas that can be examined to determine when a document was drawn up or whether its date is false. The results of these tests do not always provide conclusive evidence of fraud. They can, however, draw attention to irregularities that must be reconciled before a suspect document can be relied on as a genuine.

571

The design of watermarks can also change over time as relief areas of a dandy roll suffer damage through normal wear and tear. Detached or broken wires produce slight but visible changes in the design which is transferred to the paper. Paper mills usually keep records when dandy roll damage occurred and when repairs were made. This information can be very helpful in narrowing the period during which a watermarked paper was manufactured. A few paper companies have intentionally changed the design of their watermarks from time to time. Such watermarks are said to contain a `date tag', which will often indicate the year that a sheet of paper was produced. For example, Southworth Paper Company placed a short bar below the letters in their watermark to indicate the last digit of the year in which the paper was manufactured (Fig. 1). If a document bears a watermark that was not in existence when it was allegedly dated, the genuineness of its date must surely be challenged. When using watermarks to date paper, it is strongly recommended that the paper manufacturer be contacted to verify the time period when the noted features were present. Paper composition

Watermarks

Over the years, different fillers, surface coatings or chemical additives have been added during the paper making process to improve the quality of the product. Other changes in the manufacturing processes have occurred for economic or environmental reasons. These innovations and modifications can establish the earliest date or period a particular sheet of paper was manufactured. Many North American paper manufacturers stopped producing acidic paper in favor of alkaline or neutral process papers during the late 1980s and early 1990s. A simple pH test can indicate if a questioned document was produced before its purported date. This finding can be corroborated if

Conventional paper watermarks are produced during the manufacturing process by a `dandy roll' cylinder located at the beginning of the papermaking machine where paper is formed into a web. The dandy roll cylinder consists of a woven wire gauze onto which raised designs are soldered or otherwise attached. A watermark is created when the relief areas of the dandy roll press into and displace paper fibers. Paper mills usually maintain accurate records concerning their watermarks. Once the paper manufacturer of a questioned document is known, the company can be contacted to determine the earliest date that a watermark design was used. Any document dated earlier than this time must have been backdated.

Figure 1 The short vertical bar beneath the letter `E' in this watermark confirms the sheet of paper was manufactured during 1966.

Paper Products

572 DOCUMENT ANALYSIS/Document Dating

certain chemicals that were introduced after the date on the document are present in the paper. For example, when mills converted their operations to an alkaline process, many also began using calcium carbonate (CaCO3) as a substitute for titanium dioxide (TiO2) in order to improve the brightness and opacity of papers. Caution should be exercised when interpreting such evidence and the paper manufacturer should be consulted to confirm when the observed processes and materials were introduced. Speciality papers can also contain information of dating significance. For example, NCR (No Carbon Required) paper first appeared in the United States during 1954. The formula for manufacturing this product was changed several times during the 1960s and 1970s. In 1972, NCR developed a coding scheme to identify the source and date of its papers. Trace amounts of various high atomic weight elements have been added by other manufacturers as a means of tagging their products. The dates of documents produced on speciality papers that contain tags can be verified by taking such information into account. Envelopes

Envelopes are often discarded once their contents are removed. This is unfortunate since an envelope may contain important information about when it was mailed and possibly when its contents were prepared. The following envelope areas can have dating significance: postage stamps, postage cancellation marks, envelope shape and printed information. Postage stamps affixed to envelopes can be examined to determine if they were available when the envelope's contents were prepared. A new postage stamp is released for sale as a `first day cover' on a particular date. Postal officials or a knowledgeable stamp collector should be able to provide the precise date a stamp was issued. Once this date is known, the envelope and its contents must have been mailed some time after this period. Stamps on many envelopes bear cancellation marks that are applied by the post office. Even if a cancellation mark is not legible, the format of the mark, the way it was struck and the chemical composition of ink can serve to establish the period when it was applied. Occasionally, logos or product codes are applied to envelopes while they are being manufactured which can have dating significance. The impression shown in Fig. 2 was found on the inside flap of an envelope manufactured by Tenison Envelope Company. This mark represents the stock number (20), the initials of the company that placed the order (EC) and the number (5) corresponding to the last digit in the

Figure 2 A notation `20EC5' on the inside flap of an envelope represents the stock number (20), the intials of the company that placed the order (EC) and the last digit in the year of manufacture (5).

year it was manufactured. The envelope manufacturer should always be contacted to confirm the accuracy of dating information. The design and appearance of some envelopes are unique to their manufacturers and these features may well indicate when they were produced. These include, but are not limited to, the following: . small irregularities along the edges of the paper related to a damaged die stamp; . types of adhesives applied to the side-seams and flap areas of the envelope; . striation patterns in adhesive layers associated with the method of application. Other areas sometimes overlooked are addresses which appear on an envelope. A particular mailing or return address may not have existed when the document was supposed to have been sent. Postal or zip codes change from time to time and these should always be checked to insure they existed during the period in question.

Inks and Writing Instruments One of the most challenging dating problems facing the document examiner is estimating when a particular document was signed or written. If a document was supposed to have been written many years ago, it may be possible to prove it was backdated if the type of pen and writing materials used were not available at that time. Important milestone events concerning the development of modern writing materials are shown in Table 1 along with their dates of introduction. Clues as to when a document was signed can also be found by analyzing the questioned writing ink. A small sample of ink removed from a document can be

DOCUMENT ANALYSIS/Document Dating Table 1 Significant dates of introduction in the history of writing instruments Year

Historical development

624 1662 1700 1780 1857 1945 1951 1955 1963 1968 1979

Earliest reference to the quill pen Pencils made in Nuremberg, Germany Early reference to steel pens Steel pens made in England by Samuel Harrison First appearance of `copying pencils' Ballpoint pen first marketed in New York city Felt-tip markers introduced Liquid lead pencil introduced Fiber-tip pen first produced Roller ball pen first produced Eraser Mate erasable pen introduced by Paper Mate

separated into its solid components by thin layer chromatography (TLC). The result of this analysis is a chromatogram that isolates the different dyes present in the ink formulation on a coated glass or plastic plate. Success of this method relies on the different physical and chemical properties of the ink and the existence of a sufficiently complete set of ink reference standards. TLC can also detect the presence of tags which have been added to some writing inks by their manufacturers. During the 1970s, several US ink producers participated in an ink tagging program organized by the Alcohol, Tobacco and Firearms (ATF) Laboratory in the United States. This scheme urged ink manufacturers to add trace amounts of different materials with distinct properties to their inks. These materials would be changed annually and thereby indicate the year an ink was manufactured. By 1978, approximately 40% of writing inks produced in the United States contained such dating tags. Although this initiative greatly increased the ability of forensic scientists to date domestic writing inks, the continued growth of imported products threatened the success of the program. Although most ink manufacturers withdrew from the tagging program by the early 1980s, documents purportedly written before this period may contain chemical taggants that suggest they were manufactured at a much later date. Ink chemists have observed that many writing inks begin to change or age the instant they are applied to paper. Most people have noticed writing inks fade or become lighter with the passage of time. In addition to this obvious physical transition, investigations have shown that the chemical composition of an ink also changes over several months or years. These effects are especially true with respect to the color, solubility and solvent volatility of the writing inks. In 1995, Brunelle suggested a technique wherein two samples of a single ink entry are removed for

573

testing. After artificially aging one sample by exposing it to heat, both samples are analyzed and the test results compared. It was discovered that ink parameters level off after several years of natural aging. This artificial aging technique is based on the hypothesis that induced aging will take an ink to where it would be if it had aged naturally. If differences between the two tested samples are slight, the result suggests the ink entry was on the paper for some time. Greater differences in solvent extraction are indicative of more recent ink entries. Other testing methods rely on sophisticated analytical techniques such as gas chromatography/mass spectrometry (GC/MS) to measure the concentration of volatile components in an ink sample. This technique also requires two samples be taken from the suspect ink entry. After exposing one to heat, both samples are tested and the extent to which their solvent components differ provides an estimate of when the ink entry was written. This method is better suited for entries made within 12 months of testing. The described methods are beyond all but a few specialists who possess the equipment, knowledge and experience needed to analyze and date writing inks. Some controversy still surrounds certain ink testing methods and further validation studies could resolve these debates.

Commercially Printed Documents Many documents subjected to forensic examinations take the form of documents with letterheads, contracts, envelopes, notary records, receipts and other types of printed stationery. Apart from typewriting, handwriting and other information they may contain, commercial printing on documents can be used to establish whether they were produced during or after a certain period. Minuscule printing defects such as irregular letter outlines, uneven inking or small breaks in line work can associate a questioned document with a particular stationery order produced by a commercial printer. Once the company that produced a printed document is identified, more precise information about when the order was delivered and the earliest time the stock was put into circulation can be determined. Access to samples from the order retained by the print shop can also be of value when attempting to date commercially printed documents. A coded mark within the body of a print job can also provide important information about a print job. For example, the bottom of a medical form shown in Fig. 3 bears the notation `AC1215R0'. The printer used this number to trace the advertisement to the client. Information about the order indicated when

574 DOCUMENT ANALYSIS/Document Dating

Figure 3 The alphanumeric code `AC1215R0' within this advertisement on a patient's medical form was used to establish the date the stationery was printed.

the stationery was distributed. In this case, the advertising campaign was not authorized until three years after the patient records were supposed to have been written on the printed form. This provided irrefutable proof that the medical records had been prepared long after the patient was examined by the physician.

Typewriting The typewriting technology used to produce a questioned document is one of the first factors that should be considered when its date is at issue. During the last century, many advances have occurred in the development of the modern typewriter. Some important events and when they occurred are listed in Table 2. The date a typewritten document was prepared can be determined in other ways. One method considers the typestyle which appears on a questioned document. The shape and size of typed letters can indicate the make(s) and model(s) of typewriter(s) which might have been used to produce the typewriting. The results of searching a large collection of typewriter specimens can indicate that the questioned typestyle was introduced to the market on a particular date. Should the typestyle's date of introduction be later than the date on the suspect document, the questioned document must certainly be regarded with suspicion. A second method of dating typescript takes into account any typeface defects present in the questioned typewritten text. Typewriters contain many moving parts which gradually become worn or defective with use. These defective components produce misaligned or damaged letters that become quite apparent when examined with a microscope. Subsequent adjustments or repairs by a service technician can create further changes to the appearance of typewriting produced by a machine. The dates when typewriter damage occurred or disappeared are very significant for dating purposes.

Table 2 Significant dates of introduction in the development of the typewriter Year

Technological development

1909 1927 1944 1956

First use of bi-colored ribbon (Underwood) First use of carbon ribbon (Hammond-Varityper) IBM Executive proportional spaced typewriter Remington Statesman the first proportional typewriter by Remington First Underwood proportional spaced typewriter Underwood electric standard typewriter with duplex carbon and fabric ribbons IBM Selectric I dual pitch single element typewriter First use of IBM Selectric polyethylene film ribbon IBM Selectric II dual escapement, half backspace machine Tech III ribbon cartridge for IBM Selectric First daisywheel produced by Diablo Systems IBM Correcting Selectric II with special lift-off ribbon Thermal transfer ribbon developed by IBM First use of polyurethane ribbons (Olivetti) First dot matrix printer for personal computer (Epson TX 80) IBM Electronic 65 and 85 typewriters with triple pitch and right justification Brother EP-20 seven-pin thermal typewriter Diablo releases EPM 1 ± first thermal ribbon transfer printer IBM Quietwriter with nonimpact thermal print head Quietwriter ribbon by IBM

1960 1960 1961 1963 1971 1971 1972 1973 1975 1977 1978 1982 1982 1984 1984 1984

If a typewriter is not cleaned regularly, oil, ribbon particles, dirt and paper fibers can accumulate within the crevices of certain letters. When dirty typefaces strike the paper through the ribbon, the letters appear filled-in rather than clear letters and numbers. These imperfections will remain until the dirt is removed by cleaning the typefaces. Access to uncontested documents produced on the same typewriter over a period of time will reveal when changes to the appearance of the typescript occurred. Fig. 4 shows how the appearance of typeface dirt and damage can expose a fraudulent document.

DOCUMENT ANALYSIS/Document Dating

575

Figure 4 The questioned document could not have been typed on June 12th, 1996. Damage to the digit `9' and the filled-in body of the `6' occurred sometime after August 6, 1996.

Typewriter single-strike and correcting ribbons can also indicate the date when documents were produced on a particular typewriter. A used single-strike ribbon will contain impressions of all the characters struck by the machine in chronological order since the ribbon was last changed. If the typewriter ribbon used to produce a questioned document is available for inspection, it can be examined to insure the date of a questioned typewritten document is contemporaneous with the dates of typed documents which precede and follow it. If it is not, dated correspondence appearing immediately before and after the location of the question passage can serve to determine the approximate period when the contested document was typed. Correction fluids applied to conceal typing errors can also help date a typewritten document. Wite-Out Company first introduced this product to the market in 1965. In 1984, Liquid Paper introduced colored correcting fluid to mask corrections on different colored paper stock. The presence of these materials on a typewritten document before their respective introductory dates will strongly suggest a document has been backdated. Correcting fluids are complex substances composed of different resins, plasticizers, pigments, solvents and binders. The manufacturer of a correcting fluid can be identified by extracting a sample from the document; analyzing it by infrared spectroscopy and

comparing the result to a database of correcting fluid spectra. Once known, the manufacturer can be contacted to determine when a particular correcting fluid formulation was first produced. Of course, a correcting fluid could not have been applied to a questioned document before its date of introduction.

Photocopiers Photocopied documents that suddenly surface during a litigation are often regarded with suspicion. In some cases, these documents are genuine but in other instances, they are produced at the last moment with an astonishing story that they were just discovered recently by some strange coincidence. The subject of interest in these cases is not when the original document was produced but rather the date or period it was photocopied. Three facets of photocopied documents that have dating significance include: the copier technology used, the presence of copier defects, and the properties of the toner and/or paper. Copier technologies

Just as milestone events in the development of the typewriter are useful for dating purposes, the date of a copied document can be checked against the release date of a particular office technology to insure it was available when the document was allegedly produced.

576 DOCUMENT ANALYSIS/Document Dating

Different copier technologies include: (1) dual spectrum; (2) stabilization; (3) diffusion transfer; (4) indirect electrostatic; (5) diazo; (6) dye transfer; (7) direct electrostatic; (8) thermographic; and (9) laser. A questioned copied document should be checked to insure its date follows the introductory date of the technology used to produce it, keeping in mind that introductory dates may vary from region to region. Examination of defects

The most straightforward means of dating photocopied documents relies on defects, `trash marks' or small flecks of toner that appear in `white' areas of a copied document. These marks can originate from dirt, foreign material or defects on the glass, platen cover or photosensitive drum of the photocopier (Fig. 5). Scratches to the glass or drum, tend to be more permanent and will generate marks on copies produced by a machine until such time as the defective component is removed and replaced. The temporary nature of other defects, such as those originating from dirt or foreign material on the glass, lid or internal components, are temporary in that they can be removed by cleaning the copier surfaces. Genuine photocopied documents made by the same copier that produced the questioned document provide an excellent means of confirming its date. Logs and service records maintained by repair technicians are also helpful in that they often contain photocopies produced before and after copier repairs were made. Toner analysis

Most photocopier toners consist of: a pigment (usually carbon black); a binder which fixes the pigment to the paper (usually an organic resin such as polystyrene); and additives used to improve the properties of the toner. When any of these components are changed, the event can provide a useful means of dating photocopied documents. Analysis of photocopier toners by infrared spectroscopy and scanning electron microscope equipment with energy dispersive spectrometry can yield information about the chemical and physical properties of toner. A comprehensive library of toners can be used to establish initial production dates. In some cases, the manufacturer will confirm that a particular ingredient was first used several years after the date the photocopy was supposed to be prepared. This would constitute conclusive evidence that the alleged date of the photocopy was false. The process used to fuse toner to the paper can vary from one photocopier to another. Older photocopiers use cold pressure fusing wherein toner is pressed into the paper surface. Newer generations use either heat

Figure 5 The combination of photocopier `trash' marks on the questioned document (top) emerged during the period August 3, 1995 to September 8, 1995 and could not have occurred on July 15th, 1995 when copies of the questioned document were allegedly prepared.

alone or both heat and pressure to fuse toner to the surface of the paper. The date a given fusing process first appeared is the earliest that a photocopy bearing this technology could have been produced. In 1992, it was reported that indentations are imparted to the surface of toner by damage to the surface of a copier's fusing rollers. Fusing roller defects occur through normal wear and tear. They vary with time and consequently the indentations they produce in the surface of toner can be used to estimate when a given photocopied document was produced.

Handwriting and Signatures The writing of many individuals does not change significantly for most of their adult life. However, despite the constant and repetitive nature of developed handwriting, practically everyone has noticed that their signatures and handwriting do change ± especially over long periods of time. The development, progression, and eventual disappearance of handwriting features can be very helpful in solving dating problems. Access to a quantity of specimen material produced during a period of time can show that writers change the shape of certain letters or the form of their signatures (Fig. 6). The quantity of

DOCUMENT ANALYSIS/Document Dating

577

document was prepared after its purported date. When preparing a postdated or backdated document, the writer may not remember what verb tense to use. Such inconsistencies, especially when repeated, provide a good indication that something is amiss. When preparing business correspondence, the typist's initials are often placed at the bottom of the document. In fraudulent documents, the initials of a typist who is currently employed by a company may be used instead of the person who held the position on the date that appears on the document.

Computer-printed Documents

Figure 6 Six signatures produced by a writer during a ten year period show some features that have a temporal significance.

specimens required for this purpose will depend on many factors including: (1) how rapidly the writing changes; (2) what factor(s) influenced the changes; and (3) the number of specimen writings prepared near the period in question. Once the specimens are arranged in chronological order, it is often possible to date a disputed writing within a particular time period. Rapid changes in a person's writing can result from the sudden onset of a serious illness, the administration of therapeutic drugs or the consequence of a debilitating accident. Although such sudden transitions can create problems for the document examiner, they also provide a means of determining when a questioned signature or handwriting might have been produced.

Contents of a Document Proof that a document was backdated or postdated can occasionally be found within its contents. These details are often overlooked by the perpetrator as his attention is focused on producing a document that contains the right information. Names, addresses, postal codes, phone numbers, trade names, and job titles mentioned in a document might provide evidence that it was produced at a different time. Events are occasionally mentioned in correspondence that did not occur until months or years after the date appearing on the document. Verb tenses in relation to events mentioned can also indicate a

Dating computer printed documents is approached in much the same manner as dating typewritten documents. The debut of computer printer technologies are all associated with a date of introduction. Consequently, any document produced by a daisy-wheel, dot-matrix, inkjet or laser printer cannot bear a date that precedes the respective periods when these printers first appeared on the market. Daisy-wheel printers

The daisy-wheel printer, using a similar impact technology to the typewriter, bridged the gap between typewriters and later generations of computer printers. Although very popular during the 1970s, few daisy-wheel printers are still in use today. The print elements of these machines contain a full set of characters positioned on the end of long spokes attached to a central hub. As the elements spin on a central shaft, the characters are struck at the appropriate time from behind with a plunger. The action of the character striking the paper through an inked ribbon produces a letter on a document. Like their typewritten counterparts, documents produced by daisy-wheel printers can be dated by considering irregularities in the alignment of letters or damage to their outlines through wear and tear. The source of other temporal defects can be traced to faulty moving components of the printer. These changes provide a means for dating the work of a particular printer. It should be kept in mind, however, that daisy-wheels can be easily removed, discarded and replaced by a new element. All defects associated with the old daisy-wheel will disappear and only those that relate to the printer will remain. Dot-matrix printers

Dot-matrix printers gained popularity during the early 1980s. Early models had nine metal pins arranged along a vertical axis that struck the paper through an inked ribbon while the printhead moved

DOCUMENT ANALYSIS/Document Dating

Other factors worthy of consideration can be found under the `Contents of a Document' heading of this chapter.

Cachet Impressions The development of rubber stamps followed the discovery of vulcanizing rubber by Charles Goodyear. The first commercial production of rubber stamps occurred in 1864. Since that time, the processes used to manufacture stamps have undergone several improvements as the demand for better quality rubber stamps increased. The first pre-inked stamp, Perma Stamp was produced in 1958. These stamps are still a popular item in stationery stores. Although today's stamps are still referred to as `rubber stamps', most stamps are now produced from a plastic-based photopolymer material. Both rubber and plastic deteriorate over time. The relief edges of a stamp can crack or break off, an ink/ dirt mixture can clog deep crevices and the relief areas of a stamp can become worn through constant use. These events introduce flaws that are reproduced in the impressions produced by a worn stamp. The approximate period when a stamp impression was made can be determined by comparing its defects with standards from the same stamp arranged in chronological order. Another method by which stamp impressions can be dated involves changes to the size of some stamps with time. It has been found that stamps can shrink as much as 1.5 mm during a four-year period. Although this phenomenon is relatively rare, it does provide yet another means of dating stamp impressions.

Glues, Tapes and Paper Fasteners Adhesives used to manufacture envelopes, stationery pads and tapes occasionally undergo changes or modifications to improve their properties. Such changes can be used to establish the earliest date that a document manufactured with a given adhesive was produced. The stationery manufacturer or adhesive company should always be contacted to verify the date when a particular adhesive was first used. Lift-off tape was introduced by IBM to facilitate the correction of typewriting errors. This innovation, first introduced to the market by IBM on the 1st of April 1973, removed unwanted typed characters by overstriking letters through the lift-off tape. This action would lift the letter from the document and allow the typist to correct errors with little disturbance to the paper surface.

579

Indented Writing Indented handwritten impressions made in the surface of a document can reveal important information about whether written entries on a piece of paper were made before or after the indented writing occurred. Such sequence determinations are confirmed by subjecting the document to an ElectroStatic Detection Apparatus (ESDA) examination. It is often possible to establish the exact date when indented handwritten impressions on a document were produced. An ESDA examination that establishes the visible writing on a questioned document was made after dated indented impressions can provide an unusual but effective method for confirming the document was backdated. Handwritten entries in a journal, ledger, note pad or receipt book usually produce indented impressions on underlying sheets of paper. If it is necessary to date one of the sheets which was removed, its original location can be confirmed by matching writing on the document with corresponding impressions on the other bound papers. If the dates on adjacent pages are reliable, this simple method enables the document examiner to place the questioned document within a particular time frame.

Guillotine Marks The exposed edges of receipt books, reams of paper and stationery pads may contain marks produced by cutters or guillotine blades used to trim these products to size. These stria, often referred to as `guillotine marks', do not run perpendicular to the surface of the paper but run at an angel across the trimmed surfaces. Their locations along the four edges of a document can indicate where a sheet was positioned in the original stack of paper. Access to several documents from the same stack of paper is needed to establish a cutting pattern against which the contested document will be compared. Once the location of guillotine marks on the four edges of the questioned sheet match the position of sheets from the same lot, any dating information on adjacent sheets can be used to determine when the questioned document was written. If the questioned document is not contemporaneous with information on adjacent sheets of stationery, some plausible explanation should be sought.

Summary Many methods can be employed to determine if a questioned document's date has been falsified. People who fraudulently alter or misrepresent the date of a

580 DOCUMENT ANALYSIS/Forgery/Counterfeits

document are usually careful to ensure its general appearance will meet close scrutiny. Consequently, it is better to approach document dating problems from a broader perspective rather than focusing attention on those areas which immediately arouse suspicion. Any decision to limit the scope of forensic investigations in the interest of saving time or money should be weighed carefully. Solutions to document dating problems are often dependent on an inspection of all areas of a document for details confirming whether it was prepared on a given date. Such an approach will insure that a thorough investigation is carried out and crucial evidence will not be overlooked. See also: Document Analysis: Handwriting; Analytical Methods; Forgery/Counterfeits; Ink Analysis.

Further Reading Blackledge RD and Gernandt MN (1993) The pH pen ± a means of comparing paper products. Journal of Forensic Sciences 38:134±142. Brunelle RL (1995) A sequential multiple approach to determining the relative age of writing inks. International Journal of Forensic Document Examiners 1:94± 98. Brunelle RL (1992) Ink dating ± the state of the art. Journal of Forensic Sciences 37:113±124. Brunelle RL and Cantu AA (1987) A critical evaluation of current ink dating technique. Journal of Forensic Sciences 32:1522±1536. Brunelle RL and Reed RW (1984) Forensic Examination of Ink and Paper. Springfield: Charles C. Thomas. Cantu AA and Prough RS (1987) On the relative aging of ink ± the solvent extraction technique. Journal of Forensic Sciences 32:1151±1174. Cantu AA (1996) A sketch of analytical method for document dating Part II. The dynamic approach: determining age dependent analytical profiles. International Journal of Questioned Document Examiners. 2:192±208. (Errata in 2:570±571) Gerhart J (1992) Identification of photocopiers from fusing roller defects. Journal of Forensic Sciences 37:130±139. Godown L (1969) Forgeries over genuine signatures. Journal of Forensic Sciences 14:463±468. Kelly JH (1983) Classification and identification of modern office copiers. Houston: American Board of Forensic Document Examiners Inc. Nickell J (1990) Pen, Ink, & Evidence. Lexington: The University Press of Kentucky. Osborn AS (1929) Questioned Documents, 2nd edn. Albany: Boyd Printing Co. Purtell DJ (1980) Dating a signature. Forensic Science International 15:243±248. Starrs J (1991) The case of the doctor who doctored the documents. Scientific Sleuthing Review 15:1. Totty RN (1990) The examination of photocopy documents. Forensic Science International 46:121±126.

Forgery/Counterfeits P W Pfefferli, Kantonspolizei, Zurich, Switzerland Copyright # 2000 Academic Press doi:10.1006/rwfs.2000.0478

Introduction Forensic document examination is a complex matter requiring various areas of expertise to identify document forgeries of all kinds. Although in the modern office the electronically mailed document is of growing importance, the traditional (paper) document still has its place, and thousands of different kinds are used for documentation purposes. The threat of illegal document forgery exists and will always exist. The examination of questioned documents is an ongoing challenge to forensic sciences, to cope with the modern technology of document manufacturing and the increasingly sophisticated document forgeries. The many facets of modern documents demand many areas of expertise from forensic specialists in order to identify and authenticate a questioned document. The identification of handwriting is a discipline of its own, requiring for appropriate trained experts to compare and identify handwritings. The aim of the examination of technical typewriting and printing produced by office machines is to determine typestyle and origin. In addition to the written or printed content, it is necessary to examine other document components. Ink and paper examination, by nondestructive and analytical methods and techniques, help to determine its authenticity with respect to origin. These areas are equally relevant in general questioned document examination, but when documents of high value and protected by the law are fabricated for criminal purposes, the forensic document analysis may be of even higher importance and special expertise is required. Counterfeiting and forgery of value and security documents occurs on a large scale.

The Threat Counterfeited documents are documents that are reproduced as originals. The entire document is a fake, e.g. counterfeited banknotes, bonds, checks, vouchers, driving licenses, lottery and admission tickets, stamps, certificates etc. If the reproduction is made by using materials and procedures which do not correspond to the original, the counterfeit is called an imitation. Forged documents are altered originals produced by adding, removing or substituting relevant information or features, for example a modified check

DOCUMENT ANALYSIS/Forgery/Counterfeits

amount, an imitated signature on a contract, altered passport or gift certificate, altered payment card or credit card. The counterfeiting of banknotes, bonds, checks or driving licenses and the illegal reproduction of passports and travel documents and check and credit card fraud are high profile crimes, committed mostly not by an individual, but by criminal organizations involved in terrorism, illegal cross-border traffic, drug trafficking, financial transactions or other activities of organized crime. By definition, such highly valuable so-called security documents, such as banknotes and passports, should be specially protected against misuse. The higher the value of a document (absolute or relative) and the greater the damage caused by fraudulent actions, the higher the risk of fraud. Therefore, there will be greater protection of the document against fraud. However, a great number of these documents are still too easy to counterfeit, because they do not meet the minimum standard of manufacturing. If a banknote of reasonable quality can be reproduced by the use of modern desk top publishing or simply with a full color copier, then document securities are missing. If a security document, such as a passport, can easily be altered by substitution of the passport owner's photograph or by chemical eradication of the passport entries, the document securities of the passport do not meet the necessary standard to prevent counterfeiting and forgery. The threat of document counterfeiting and forgery has become twofold, due to the quantity and the quality of counterfeited and forged documents. The increase of fake documents of all kinds, the flood of low-profile security document fraud, mainly for immigration and cross-border purposes as well as the frighteningly good quality of some seized currency counterfeits, give rise to concern, which is much greater than just a forensic dimension. Document fraud by counterfeiting and forgery is no longer a form of crime exclusively encountered in white collar crimes or secret intelligence activities. Document counterfeit and forgery is nowadays found in all forms of crime. Statistics regarding the most often counterfeited currency worldwide ± the US dollar ± or the number of seized fake travel documents at border controls and immigration services, show frighteningly high figures for these trans-national phenomena. The relevant question of the document examiner `genuine or false?' is certainly not trivial. What is considered genuine and what is considered fake? Even valuable documents are too often of such poor quality that it is not particularly difficult to imitate them. The improved technology of modern office machines has meant that almost perfect reproductions

581

of an original can be produced. This is unfortunately true not only for low profile documents used in daily business, but also for security documents. The full color copier has become the most often used tool for illegally reproducing value documents. Used as a printer device linked with a computer, it offers a wide range of technical features to match the copy to the original. Colors can be balanced, numberings changed or signatures scanned. Even some of the traditional security features, for example the security thread of banknotes, can easily be imitated. Banknotes are documents which are normally not altered, but counterfeited, however, the situation is different in the case of check fraud. Bank checks and personal checks are value documents which are, or should be, protected against misuse as banknotes are. However, the level of securities is mostly considerably lower, making it even easier for criminals to forge. Besides reproducing the entire check from scratch, the threat of check fraud comes from altered written checks and forged stolen blank checks. The main obstacle to altering an already written check is the erasing and substituting of entries without revealing the changes. In the case of forged blank checks the important challenge for the forger is to imitate the check owner's signature. Another category of faked documents, similar in complexity to check fraud, are counterfeited and forged identity documents. The attraction to the criminal forger is ± unlike banknotes and checks ± not the pecuniary value, but the ability to create a new identity. Since modern identity documents, such as passports or ID cards and driving licenses, are complex documents with respect to manufacturing and technical set-up, it is easier and quicker to alter genuine documents than to counterfeit an entire document. Statistics from immigration services forgery desk examination make it clear that among the hundreds of different ID documents used worldwide, there are still too many in which the substitution of the identity of the document holder is not a difficult task for a skilled forger. As for check fraud, one of the forger's difficulties is the alteration of typewritten and/or handwritten entries. Moreover, the document holder's photograph must be substituted, quite often this is not a difficult task, since the weakest link of most easily altered ID documents is the document's protection against substitution of the photograph. Many of these documents have ring staples and dry or wet stamp cachets to secure the photograph, which do not give any protection against substitution. Even thin-laminate sealed photographs are no problem for the professional forger who has little difficulty in splitting the photograph substrate in half to get access to the picture without breaking the laminate.

582 DOCUMENT ANALYSIS/Forgery/Counterfeits

A final category of document complexity are the machine-readable documents, such as payment cards and credit cards, and also plastic card legitimization documents, for example modern identity cards, driving licenses and the various types of smart cards. The threat of misuse of plastic money and plastic cards is inescapable and this form of fraud is increasing dramatically. Small-scale forgeries involve the altering of stolen cards. In addition to altering the entries on the plastic substrate, the manipulation of the stored information on the magnetic strip, the electronic chip, is an additional difficulty. However, this obstacle can be overcome if necessary. The threat of today's card fraud is, however, the amount of organized crime involved in forgery and the counterfeit of plastic cards. The criminal organizations produce blank cards with machine-readable devices, which are then delivered to the customer for encoding and, if necessary, to be completed by printing, embossing or additional optical security devices (for example hologram). It is true that despite the high quality of some professionally produced forgeries and counterfeits of security documents, the forensic specialists have little difficulty detecting the fraud when checking a questioned document thoroughly. The recipient of these counterfeited documents, however, is likely to be an unskilled and not technically equipped customer.

Document security It goes without saying, that there are different classes of documents, according to the probability of fraud, the damage caused by it and the absolute as well as the relative value of the document. The class which is best protected against counterfeiting and forgery is high-value documents, such as banknotes, passports, checks and credit cards. Whereas other value documents, such as stamps, vouchers, certificates, admission tickets, stamps, lottery tickets, visa documents, permits and many others may be considered as a class of lower security value and therefore also of lower document security protection. The understanding of the counterfeiting and forgery potential of different types of document demands an enhanced know-how of the state of the art of technical document securities and the respective possibilities and limits. Generally speaking, there are three approaches to improve the technical security of a document against counterfeiting and forgery. First there is the use of exclusive materials and controlled substances: the higher the value of a document, the more exclusive the materials for manufacturing should be. Controlled substances should be

produced by a restricted number of manufacturers and not normally used for the production of common documents; for example paper from specialized paper mills, paper containing special fibers, papers without optical brightener, multilayer polymers for synthetic documents, printing inks of particular spectral composition, printing inks specially resistant to chemical eradication or alternatively, especially sensitive to chemical attacks etc. Secondly security printing techniques should be used. Besides offset as the most common technique used in printing, special printing techniques such as letterpress, intaglio (relief printing) and silk-screen are highly effective and not easy to imitate. Thirdly, additional security attributes should be used. There are various security devices to improve the protection of a document against counterfeiting and forgery. These are used either in combination with the document materials during manufacturing or added on the printed document. These modern security devices include (among others): . Paper securities: watermarks; fluorescent fibers and planchettes; . Printing securities: guilloche pattern (printed background pattern of interlacing fine lines); simultaneous printing (perfect fitting of recto/verso printing); fluorescent and magnetic inks; optically variable inks (ink taking on different colors depending on the angle of viewing); rainbow printing (continuous change of colors); microprinting (extra small printing to be seen only after magnification); latent images (visualization depending on angle of viewing); scrambled indicia (scrambled latent image, only visible through a special lens); . Securities of personalized entries: text printed by use of matrix printers or laser printer; digitized laser printing of text, photos or signatures; . securities to prevent substitution of pages, photos: staples; embossing stamps (dry stamps), stamp cachets; optically variable devices OVD (holograms, kinegrams, latent images); protective films (thin laminates) with ink printing, retro-reflectivepattern, diffraction grating image; perforations; . machine readable securities: OCR printing; magnetic strips.

Methods of Examination The methodology of document counterfeit and forgery analysis is first a question of where the authenticity checking takes place. Depending on the form of fraud and the type of document involved, a first examination will not necessarily be done in the document laboratory, but at the first line of

DOCUMENT ANALYSIS/Forgery/Counterfeits

inspection; for example bank institutions, immigration services, border controls, social security services etc. Therefore, the personnel should be capable of identifying a false document (in the time available and technical support) before sending it to the forensic document laboratory for thorough checking. For suspect documents, that are not identified by a first line of checking, the entire examination process will be handled by forensic experts to confirm or refute the suspicion. There are three levels of detection of counterfeited or forged documents, depending on the authenticity features to be checked. Level 1 includes features, which can be visually examined without special equipment, such as watermarks, security threads, relief structures, latent images, stamps (dry stamps or stamp cachets), OVD (e.g. kinegrams), mechanical erasure, perforations of staples, residues of adhesives, obliterated writing and other visible traces of manipulation. Level 2 refers to features to be checked with technical facilities such as: visible light to look at printing quality, traces of substitution or relief effects; UV light to detect UV-fluorescent securities (paper bleaching, fibers, printing) and UV-visible forgery traces (chemical eradication); infrared radiation to examine writing inks; reading devices to detect magnetic printing; special viewing systems for retroreflective securities; reading systems for machine readable devices. Level 3 examinations have to be carried out in the document laboratory, with sophisticated equipment that can not be used for field examination. . Electrostatic examination of latent impressions of handwriting and detection of indentations (indentations of erased writings, traced signatures on checks or passports); . Juxtaposition as well as superposition comparison with the microscope or by digital image processing, to visualize faint printing defects; . High magnification microscopy examination to detect trace evidence of mechanical erasure or substitution (residues of writing and printing ink, adhesives; traces of cutting, evidence for manipulation of staples, binding, stitching, etc.); . Infrared absorption and infrared luminescence examination to decipher nondestructively faint or obliterated writing and printing (traced signatures, modified stamp cachets); . Microspectrophotometric (colorimetric) analysis of the spectral composition of colors; . Chemical detection of chemical erasures; . Chemical spot reactions to check the organic and inorganic composition of document materials (paper, ink);

583

. Spectroscopic examination of organic compounds (polymers of synthetic documents, e.g. credit cards; identification of photocopy toners). The methodology follows the general system of forensic examination and standard procedures for document-related examination, based mainly on the detection of irregularities or by comparing the questioned item with an authentic specimen. An absolute opinion on the authenticity of a questioned document may, however, not always be given, even after high technology examination, simply because the differences between the original and the suspected imitation are not conclusive. For example, the authentic document may be of poor (print) quality, or the highly dangerous forms of fraud and forgery are not known. Comprehensive reference manuals and databases for highly protected security documents, particularly banknotes, passports and visas, try to keep updated collections of images from authentic documents, including close-up views and specifications of relevant security features. In addition document experts of immigration and forensic science services are networking information on detected counterfeits and forgeries. This is a valuable help for fast authenticity checking, mainly at the front line of inspection. For many other documents however, this type of reference material does not exist. This is also the case with documents that had been produced in such a variety of `official' types, that it is no longer clear what should be considered authentic! Another factor that is making the unambiguous identification of suspected questioned documents more and more difficult, is the improvement in office technology; these are also available for use in forgery and other criminal activities. Digital scanners and printers have reached a technology level able to produce documents, even security documents, of a quality standard, which makes it more and more difficult to differentiate between genuine and fake. This is particularly true for laser color copy technology with its almost unlimited software possibilities. However, combating color copy fraud is possible and technologies to prevent it are available. Either by programming the scanning software, to recognize automatically unauthorized reproduction, e.g. of banknotes and checks, or by printing on the copy a latent machine-readable code, which can lead via the manufacturer to the customer's copy machine. The detection of document counterfeits and forgery is a challenge not only to forensic sciences! See also: Forgery and Fraud: Counterfeit Currency; Payment Cards. Document Analysis: Handwriting; Ink Analysis.

584 DOCUMENT ANALYSIS/Handwriting

Further Reading ASTM Standard E 1422-98 Standard Guide for Test Methods for Forensic Writing Ink Comparison. West Conshohocken: The American Society for Testing and Materials (ASTM). Ellen D (1997) The Scientific Examination of Documents. London: Taylor & Francis. Interpol (ed.) Counterfeits & Forgeries. Amsterdam: Editions Keesing Publishers. Passport Handbook. Amsterdam: Editions Keesing Publishers. Rapp B (1990) Counterfeit I.D. Made Easy. Port Townsend, Washington: Loompanics Unlimited. Rapp B (1991) Credit Card Fraud. Port Townsend, Washington: Loompanics Unlimited. Rapp B (1991) Check Fraud Investigation. Port Townsend, Washington: Loompanics Unlimited. Van den Assem B, Brongers D, Rath J et al. (1994) Security Documents ± Practical Guide for the Security Printing Sector. The Hague: Sdu Publisher. Van Renesse R (ed) (1998) Optical Document Security. Boston, London: Artech House.

Handwriting M Vos, S Strach and P Westwood, Forensic Document Services, PO Box 543, Queanbeyan, NSW, Australia Copyright # 2000 Academic Press doi:10.1006/rwfs.2000.0475

Introduction Handwriting can be described as the formation of letters, characters or symbols, using a writing implement, according to a recognizable pattern which is designed to communicate with another person. The issue of who wrote a particular piece of handwriting can be central to many legal proceedings. Accepted ways to prove handwriting include admission by the writer or the testimony of a person who witnessed the writing. If the writer is uncooperative or not available, and there are no apparent witnesses, or the writing is otherwise in dispute, then there is a need to resort to other means of identification. There are two other means acceptable by the courts. The first is to call a person acquainted with the writer's handwriting; the second, and more reliable, is to employ the services of a forensic document examiner to undertake a comparative examination of the writing in question with

known specimen handwriting of the suspected writer of the questioned material. A document examiner may be asked to examine such diverse documents as anonymous letters, writings and/or signatures on cheques, credit cards and vouchers, wills, mortgages, other legal documents, medical records and diaries. It should be noted that, although documents generally consist of writing on paper, the forensic document examiner can be called upon to examine writings on other less conventional documents such as blackboards, whiteboards, pieces of pasta, body parts, fence posts and graffiti on buildings, walls, windows etc. Writing is taught from a model system. The act of continuously repeating a written character fixes the form of that character in the mind of the writer, normally during childhood, until the production of this form becomes `automatic'. From the moment people start learning to write, they introduce deviations from the model writing system taught. The extent of these deviations increases as the writing style becomes more personalized, resulting in a style which is the product of many factors including the model system, artistic ability, muscular control, nature of employment, frequency of writing and exposure to the writings of others. This results in an individual writing style, the development of which occurs throughout the childhood and adolescent years, and often beyond (Fig. 1). A similar evolution can be seen in the development of a person's signature with the individual practicing a certain style which changes over time under the influence of the factors described above, until an often quite individualized pictorial representation of the person's name is formed. Document examiners refer to writing characteristics attributable to a model system as being `class' or `style' characteristics. Different styles of writing are taught in different countries and sometimes regions, which accounts for some of the variability in handwriting styles. The styles taught also change over time. For example, in Australia today it is unusual to be taught the elaborate cursive style of writing which was once commonly taught. A number of terms are used by document examiners for characters found infrequently in the general population including `unusual', `personal' or possibly `individual' characteristics. The term `individual' characteristic is somewhat misleading if applied to one letter form, since one letter form even if very unusual is not sufficient to individualize, or identify, the writer. In order to distinguish the writing of any one person, the handwriting expert builds a background knowledge over time, from examination of the writings of many different people, of what can be considered common

DOCUMENT ANALYSIS/Handwriting

585

Figure 1 Ten people's writing of the place name `Queanbeyan', illustrating the differences and occasional similarities which arise in the writings of different people.

or unusual features of handwriting and how handwriting can change under different circumstances. If sufficient handwriting is present, it is the combination of rare and common features which serves to identify a particular writer. Although we use the terms forensic document examiner and handwriting expert interchangeably for the purposes of this article, it should be noted that the term `handwriting expert' is sometimes used by those who seek to determine a person's psychological characteristics from their handwriting (graphologists). Caution should be taken when engaging the services of a `handwriting expert' to ensure that the person engaged is fully trained and qualified in the field of forensic document examination. Although the bulk of the work of most forensic document examiners focuses on the scientific comparative examination of handwriting and signatures, there are document examiners who almost exclusively examine aspects of documents other than handwriting.

Handwriting Comparison When a particular piece of handwriting is called into question, the handwriting expert will examine the writing in question visually, with the aid of hand held magnifiers and with a microscope. Features such as the details of construction of individual letters and letter combinations, comparative height and size relationships of particular letters and letter combina-

tions, alignment of letters and words, slope, speed of writing, angularity, pressure, shading, diacritics and layout are considered. Constructional details such as line direction and sequences of separate strokes can often be determined from microscopic examination. Evidence of the sequence of separate strokes can sometimes be obtained by the direction of any small terminating and commencing strokes between separate parts of a character, called spurs or ticks, or faint connections between these parts, showing the direction of pen travel just before a pen lift, or just after the pen has contacted the paper following a pen lift. Usually, examination of several examples of each letter are required to make such a determination. Ball-point pen striations can also be used to determine line directions as such striations run from the inside to the outside of a curved stroke (Fig. 2). The striation pattern present at the conclusion of a stroke, may be retained on the ball of the pen and transferred to the beginning of the next stroke. This `memory effect' can be used to determine the sequence of strokes. Other characteristics of the ball-point pen stroke that allow determination of direction of stroke include `gooping' (an extra heavy deposit of ink) following a curve and dried or reduced ink starts at the beginning of lines. For this reason, it is strongly recommended that at least some of any requested set of specimen handwriting is written with a ball-point pen. Higher power microscopic (630 or more) examination can also

586 DOCUMENT ANALYSIS/Handwriting

Figure 2 Ball-point pen writings showing (A) striations and (B) reduced ink start. Arrows indicate direction of pen movement.

sometimes be used to determine line direction of ballpoint pen writing, and almost always for pencil writing. This can be determined from the build up of ink or graphite predominantly on the `upstream' side of the paper fibers which faced the approaching writing tip. The known writing of the person suspected of writing the questioned document is examined in a manner similar to that employed with respect to the questioned document. Specimen handwriting needs to be comparable in style with the questioned handwriting. For example, questioned upper case block printing should be compared with specimen upper case block printing. It is also preferable to examine specimen writing on forms of a similar printed layout. Once suitable specimen handwriting is obtained, an initial comparison is made between the known writing samples to ascertain if they can reasonably be taken to have been written by the one person; it can happen that documents which are said to bear the known writing of one person may include (at times unwittingly) the writing of other persons. This is a particular consideration when using diaries, address books or other documents where many persons may have had access to and written on the document. From the examination of specimen writing, the expert assesses how the writing of this particular individual varies within itself. Once the requirements for suitable specimen handwriting are met, the questioned and specimen handwritings are compared with each other, and an assessment made of similarities and differences between the two writings. A character in the questioned writing is considered to be similar if it, or its range of variation, falls within the range of variation for this character in the specimen handwriting. If the

character or its range of variation in the questioned writing falls outside the range of variation seen in the specimen handwriting (for example there are differences in form (shape) or in direction, number or sequence of strokes), then this is considered to be a difference. Some differences are regarded as more significant than others; for example, the repeated appearance of a different sequence or direction of strokes for a naturally written block capital letter (Fig. 3) or numeral may be regarded as a more fundamental difference than a shape difference of a lowercase cursive letter. If significant differences are found, this usually results in a conclusion that the two writings are unlikely to have been written by the same person or, alternatively, there is nothing to link the questioned and specimen writings as being by one person. Although definite negative conclusions are sometimes justified, they should be used sparingly and in special circumstances. This is because of the possibility which should be considered, although remote, of a person having two distinct handwriting styles. With similarities also, some are more significant than others. The significance is greater if it involves a handwriting feature found more rarely in the appropriate general population. This is usually assessed subjectively, based on the experience of the examiner in observing handwriting features in very many writers. The keeping of handwriting reference collections, and using such references to determine the rarity or otherwise of a particular feature, is becoming more prevalent and can provide some statistical backing for the results of handwriting comparisons. Finally the examiner, before arriving at a finding, assesses the results of the comparison process in terms of similarities and/or differences in all comparable features of the handwriting and their significance. If no significant differences are found, the examiner assesses the likelihood that all of the similarities could have occurred by chance in the writings of two people, or alternatively could have originated in one person simulating the handwriting of another without leaving any evidence (see below) of the simulation process. These are usually assessed as subjective probabilities, based on the premise (from the probability multiplication law for independent events) that the probability of very many similar handwriting features, not necessarily individually rare, occurring in combination in the writings of two people is considered extremely small or negligible. Where the probability of a chance match in the writings of two people and the probability that another person has successfully simulated the writing style of the writer of the specimens are both considered negligibly small, the document examiner reaches an unqualified conclusion that the writer of the specimens wrote the

588 DOCUMENT ANALYSIS/Handwriting

hood of a chance `match' occurring between an idiosyncratic signature and the handwriting of another person writing this signature style without knowledge of the genuine signature is significantly reduced. For most, but not all signature cases, which involve the comparison of a set of specimen signatures with generally pictorially similar questioned signature(s), the main issue is whether the questioned signature was written by the writer of the specimens, or whether the signature was written as a simulation of the style of the genuine signature. It is not possible to determine by handwriting/signature comparison methods who wrote a completely simulated signature (or handwriting). In such a simulation the normal handwriting features are distorted by the simulation process. In less complete simulations there may be evidence of the writer's natural handwriting characteristics. For most handwriting comparison cases, the main issue for generally similar writings is whether the writer of the specimens wrote the questioned writing, or whether a chance match has occurred in the writing of two people. It should be stressed that this does not mean that handwriting and signature comparisons are fundamentally different, simply that there is often a different emphasis.

General Considerations for Handwriting and Signature Comparisons For all handwriting and signature comparison cases, three main hypotheses to explain the observations must be considered. 1. The writer of the specimens wrote the questioned material. 2. A person other than the writer of the specimens wrote the questioned material, any similarities to the questioned writing having arisen by chance coincidence. 3. A person other than the writer of the specimens wrote the questioned material, any similarities to the questioned material having arisen because of a simulation process. Complications which may further arise are considerations of distortion, disguise or self-simulation of the writing in the case of hypothesis (1), combinations of possible effects of (2) and (3), multiple writers etc. The document examiner needs to consider all feasible possibilities which might explain the observations and be aware of the danger of not considering all of these possibilities.

Disguise of Handwriting and Signatures There are many types of documents on which disguised handwriting appears, from an innocently sent

Valentine's Day card to a note demanding money from a bank teller. Obvious features of a person's handwriting, such as slope and/or size, are often changed as a form of disguise. Some people will deliberately introduce letter forms that are markedly different from their usual letter forms and some will use the unaccustomed hand in their writing. In the case of the latter, the writing produced can display the effects of poor pen control and appear untidy, but the subconsciously produced letter constructions and proportions may remain approximately the same, with the possible exception of direction of some strokes. The major difficulty with most disguised writing is maintaining the disguise over a length of text. Where a basic disguise may succeed over a few words, the disguise is often forgotten over a number of sentences with the writer reverting to a natural handwriting style. A totally different style of writing may also be used as a disguise. For example, if a person normally uses printed script, cursive writing may be tried as a disguise. In this instance however, there will often be examples of the alternative style available for comparison. There are, nevertheless, some forms of carefully disguised writing for which determination of the writer from handwriting comparison methods may be difficult or impossible. Disguised signatures are written by those persons intending to later deny the signature they have written. Generally the signature produced is so close to the specimen signatures, except for one or two differences, that the document examiner will identify the signature as being genuine despite the attempted disguise (Figs 5 and 6). Self-simulation of a signature or handwriting as a form of disguise can be significantly more difficult or impossible to detect. The writer of a completely simulated signature or piece of writing may be impossible to determine.

Simulation of Handwriting and Signatures Simulation of handwriting presents a different set of problems for the potential offender. The person intending to copy the writing of another person needs to obtain some specimen writing of the other person. The copyist then has a number of options. The handwriting can be `drawn' or some form of tracing can be used to produce the simulated writing. When drawing the writing, the copyist must stop frequently to check the construction of letters and words used by the person whose writing is being simulated, considerably reducing the speed of the writing process. Where no examples of a particular letter are available, the copyist must use some other form. As a result, the writing thus produced is generally slowly written; the words

DOCUMENT ANALYSIS/Handwriting

A

589

C

B D

Figure 5 (A) Genuine signature `C. Lewis' and (B) slowly written freehand simulation of (A); (C) detail of the letter `e' from the simulated signature exhibiting poor line quality; (D) detail of the letter `w' from the simulated signature showing uncharacteristic pen lift.

B

A

C

Figure 6 (A) Genuine signature `C. Lewis' and (B) quickly written freehand simulation of (A). Signature (B) shows errors in letter proportion and size relationships and an uncharacteristic pen lift in the final part of the signature (C).

may display many pauses in writing where none would usually occur, and the letter forms may display many more variations than the genuine writing since the desire to copy the correct letter conflicts with the copyist's natural way of writing a particular letter. There may be evidence of the copyist's natural handwriting style in the simulation and other differences from the genuine writing, especially where an attempt is made to write fluently. Tracing is the second major method of simulating handwriting, with the appropriate letters and words drawn from a pool of writing available to the forger. This method, although it can be effective in suppressing the handwriting style of the copyist, almost inevitably still has the problem of lack of fluency in the writing. Even if at first glance the writing produced appears to be pictorially similar to the genuine

writing, it will almost certainly be slowly completed with many stops and pauses in the ink line. Tracing methods can also leave evidence on the questioned document, depending on the method used. For example, traced guide lines in the form of pencil transfers, carbon copy writing and indented impressions can also usually be detected by the techniques available to the forensic document examiner. Should the specimen document from which the simulation has been made become available, this may also bear such evidence in terms of matching of particular letter or word forms, or indentations of the questioned writing. Signatures contain many fewer letter forms than handwriting but present the same problems to the person attempting the simulation. A further difficulty arises with elaborate signatures as it can be difficult to determine directions and sequence of strokes. As with

590 DOCUMENT ANALYSIS/Handwriting

handwriting, it is extremely difficult to maintain both fluency and the correct forms of the signature components. Where the copyist attempts a highly fluent simulation, evidence of the simulation process is usually present in the form of substantial departures from normal letter constructions. In the case of many traced or freehand simulated signatures, as only one or two signatures are often used as models, the signatures may be far more similar to each other than would be expected of a group of genuine signatures. This is especially true for tracings.

Factors Influencing Handwriting Many factors can affect a person's handwriting, and no one person writes so consistently that each letter form is exactly the same. However, the relative method of construction, letter proportions etc. remain consistent within a small range of variation, even if the writing is completed on an uneven surface, at speed or under some other stress. More significant variations in writing style are caused by such factors as age, injuries, illness (mental or physical) with handwriting showing a reduced speed, tremor in the form of erratic impulse movements and there may also be misplaced or poorly joined strokes. Attempted imitation of this type of writing sometimes shows a high frequency tremor which may not be consistent with the tremor of the genuine writer, inconsistent letter constructions or careful retouching of strokes which exceeds the skill of the genuine writer. At times the use of medication can improve a person's handwriting for a limited period of time, and this is considered by the document examiner. The only scientific method of determining whether a piece of handwriting or a signature has been written by a particular person whose handwriting may have been affected by such factors as described above, is to obtain as much comparable writing as possible, written when the factors applied. This normally means obtaining handwriting or signature specimens written as close as possible to the date of the questioned material. Determination of the genuineness or otherwise of handwriting and/or signatures of the infirm can be among the most difficult examinations which the forensic document examiner undertakes, especially when adequate specimen signatures or handwriting reflecting the infirmity are lacking. Nevertheless, useful, if not always certain, determinations can be made by the standard methods of careful examination and comparison with the available specimens, looking in particular for similarities or differences in the more subtle features of the handwriting and/or signature.

Examination from Reproduction Documents Reproductions of handwritten documents, in the form of photocopies, fax copies and computer-imaged reproductions are often submitted to the document examiner either as questioned or specimen writings. Of necessity, examination from a reproduction provides reduced information. For example, microscopic examination is of little value, except in determining the nature of the copy, since the fine details of writings are lost in the resolution provided by the copy. Nevertheless, useful handwriting comparisons can be made from examination of reproduced documents, particularly good clear modern photocopies, although the examination is restricted mainly to the grosser pictorial features of the writing. Suitably qualified conclusions are usually expressed, along with warnings that it cannot necessarily be assumed that a true reproduction of an original document has been examined as photocopy or computer manipulation may sometimes be accomplished without leaving evidence of the manipulation in the resulting reproduction.

Other Examinations Document examination encompasses much more than comparison of handwriting and signatures. Document examiners also consider the inks and printing seen on the paper, the paper itself, folding, stamps and seals and writing impressions. All of these, together with the handwriting and signatures, go towards proving the provenance of any particular questioned document. See also: Document Analysis: Analytical Methods; Forgery/Counterfeits; Ink Analysis; Document Dating.

Further Reading Conway JVP (1959) Evidential Documents. Springfield, IL: Charles C Thomas. Ellen D (1997) The Scientific Examination of Documents, 2nd edn. London: Taylor & Francis. Harrison WR (1966) Suspect Documents. 2nd impression with supplement. London: Sweet & Maxwell. Hilton O (1982) Scientific Examination of Questioned Documents, revised edn. New York: Elsevier Science. Haber RA and Headrick AM (1959) Handwriting Identification: Facts and Fundamentals. Boca Rota, FL: CRC Press LLC. Osborn AS (1922) The Problem of Proof. Albany, NY: Matthew Bender. Osborn AS (1929) Questioned Documents, 2nd edn. Albany, NY: Boyd Printing. Osborn AS and Osborn AD (1946) Questioned Document Problems, 2nd edn. Albany, NY: Boyd Printing.

DOCUMENT ANALYSIS/Ink Analysis

Ink Analysis R L Brunelle, Brunelle Forensic Laboratories, Fredericksburg, VA, USA Copyright # 2000 Academic Press doi:10.1006/rwfs.2000.0479

Introduction Chemical and physical analysis of inks on questioned documents provides valuable information regarding their authenticity. Comparison of these chemical and physical properties of two or more inks can determine: (1) if the inks were made by the same manufacturer; (2) in some cases, whether the inks are products of the same production batch; and (3) the first production date of the specific ink formulation involved. When dating tags are detected, it is possible to determine the actual year or years when the ink was manufactured. Dating tags are unique chemicals that have been added to ball-point inks by some ink companies as a way to determine the year the ink was made. Relative age comparison tests performed on inks of the same formula and written on the same type of paper with the same storage conditions (performed by measuring changing solubility properties of inks) can estimate how long inks have been written on paper. This is done by: (1) comparing the rates and extents of extraction of questioned and known dated inks in organic solvents by thin-layer chromatography (TLC) densitometry; (2) comparing changes in dye concentrations by TLC and TLC densitometry; and (3) comparing the volatile ink components by gas chromatography±mass spectrometry (GC-MS). In cases where known dated writings are not available for comparison with questioned inks, accelerated aging (heating the ink to induce aging of the ink) can sometimes be used to estimate the age of ink using any or all of the above described techniques. Ironbased inks can be dated by measuring the migration of iron along the fibers of the paper by Scanning auger microscopy. This article describes state of the art procedures for the chemical and physical comparison, identification and dating of inks on questioned documents.

Composition of Major Types of Writing Inks Knowledge of the composition of inks is necessary to understand the reasons for the various methods used to analyze inks. Also, knowledge of the first produc-

591

tion date for each type of ink or certain ingredients in the inks is useful for dating inks. Carbon (India) ink

In its simplist form carbon inks consist of amorphous carbon shaped into a solid cake with glue. It is made into a liquid for writing by grinding the cake and suspending the particles in a water±glue medium. A pigmented dye may be used to improve the color. Liquid carbon inks are also commercially available. In the liquid carbon inks shellac and borax are used in place of animal glue and a wetting agent is added to aid in the mixing of the shellac and carbon. Carbon inks are insoluble in water, very stable and are not decomposed by air, light, heat, moisture or microbiological organisms. This class of ink has been available for more than 2000 years. Fountain pen inks

There are two types of fountain pen inks: (1) irongallotannate type and (2) aqueous solutions of synthetic dyes. Modern inks of type (2) contain synthetic blue dyes to provide an immediate blue color to the ink which gradually turns black after oxidation on paper. This explains the origin of the name blue± black fountain pen ink. This class of ink is also very stable. This ink is insoluble in water and cannot be effectively erased by abrasion. The most popular fountain pen ink (developed in the 1950s) consists of an aqueous solution of synthetic dyes. These inks are bright and attractive in color, but they are not nearly as stable as the carbon or blue±black inks. Some of the synthetic dyes used fade and are soluble in water. The most modern inks of this type contain pigmented dyes, such as copper phthalocyanine (introduced in about 1953) which makes these inks much more permanent. Ballpoint inks

The ballpoint pen was developed in Europe about 1939 and was initially distributed in Argentina about 1943. In 1946, several million Reynolds ballpoint pens reached the market in the United States. Ballpoint inks consist of synthetic dyes (sometimes carbon or graphite is also added for permanence) in various glycol solvents or benzyl alcohol. The dyes in ballpoint inks can consist of up to 50% of the total formulation. Several other ingredients are usually added to the ink to impart specific characteristics. These ingredients consist of fatty acids, resins, surface active agents, corrosion control ingredients and

592 DOCUMENT ANALYSIS/Ink Analysis

viscosity adjustors. The fatty acids (oleic is the most common) act as lubricants to the ball of the pen and they also help the starting characteristics of the ball point. Ballpoint inks made before about 1950 used oilbased solvents such as mineral oil, linseed oil, recinoleic acid, methyl and ethyl esters of recinoleic acid, glycerin monoricinoleate, coconut fatty acids, sorbital derivatives, and plasticizers such as tricresylphosphate. Modern ballpoint inks (post-1950) are referred to as glycol-based inks, because of the common use of ethylene glycol or glycol derivatives as a solvent for the dyes. Benzyl alcohol is also commonly used as the vehicle (solvent) by some ink manufacturers. Chelated dyes (introduced commercially around 1953) are stable to light. Red, green, yellow and other colored chelated dyes are now used for various colored ballpoint inks. Pressurized ballpoint inks were developed about 1968. These pens contain a pressurized feed system instead of gravity flow. The physical characteristics of these inks are quite different from the standard glycol based ballpoint inks. The composition is basically the same, but this ink does not become fluid until disturbed by the rotation of the ball point in the socket. Cartridges containing this ink are under the pressure of nitrogen or some other inert gas. The positive pressure on the ink allows the pen to write in all positions and in a vacuum. These pens are used by astronauts during space travel.

additives similar to those in rolling ball marker inks and fountain pen inks. The water-based inks are obviously water soluble, whereas the xylene-based inks are water resistant and can only be dissolved with strong organic solvents. Formamide or glycol solvents are essential ingredients in fiber tip inks to keep the fiber tip from drying out. Fiber tip inks that contain metalized dyes are light fast. Gel-pen inks

The most recent development in the writing instrument industry is the introduction of the gel-pen by the Japanese. Four brands of gel-pen inks have been introduced: (1) the Uniball Signo by Mitsubishi; (2) the Zebra J-5; (3) the Pentel Hybrid; and (4) the Sakura Gelly Roll pen. These pens have been marketed by the Japanese since the mid-1980s and a limited supply of the pens was sold in the United States about 1993. Two US manufacturers are now producing these pens. Gel inks contain completely insoluble colored pigments rather than organic dyes. Writing with this ink is very similar to the appearance of the writing with a ballpoint pen. This ink, which is water based, is a gel and not a liquid. It is insoluble both in water and strong organic solvents. This physical property makes it impossible to analyze (by traditional methods) for the purpose of comparing two or more inks of this type.

Rolling ball marker inks

Rolling ball marker inks were introduced in Japan in about 1968 and shortly thereafter in the United States. These inks are water based and usually contain organic liquids such as glycols and formamide to retard the drying of the ball point. The dyes in these inks are water soluble or acidic dye salts. The light fastness of these dyes range from good for the metalized acid dyes to poor for some of the basic dye salts. Water fastness is usually poor, except that some of these dyes have an affinity for cellulose fibers in paper which produces a degree of water fastness. Waterresistant rolling ball marker inks are also available. These inks are totally insoluble in water and can only be dissolved in strong organic solvents, such as pyridine or dimethylsulfoxide (DMSO). Fiber or porous tip pen inks

This class of inks was developed in Japan about 1962 and in the United States about 1965. Fiber tip inks are usually water or xylene based and contain dyes and

Ink Comparisons and Identifications Inks are usually examined for three reasons: 1. To compare two or more ink entries to determine similarities or differences in inks which can provide information concerning whether entries have been added or altered. 2. To determine if two or more entries were written with the same formula and batch of ink, thus providing a lead as to whether certain entries could have been written with the same pen. 3. To date ink entries to determine whether documents have been back-dated. This section deals with the first two reasons for analyzing inks. Nondestructive methods of comparison should be carried out first, because chemical analysis causes minor damage to the document by removing ink samples for analysis. Typically, the nondestructive methods include: (1) a visual and microscopic examination of the writing to assess its color and the type of pen used; (2) infrared reflectance and luminescence

DOCUMENT ANALYSIS/Ink Analysis

examinations to determine whether the inks reflect or absorb infrared light and whether the inks luminesce; and (3) viewing the inks under long- and shortwave ultraviolet light to determine if the inks are fluorescent under these wavelengths of light. Often these techniques are sufficient to determine if two or more inks are different. However, if these techniques fail to detect any differences in the inks, then further chemical analysis is necessary to determine if the inks being compared really have the same formula. The most widely used technique for comparing and identifying inks is TLC. This technique separates the dyes in the ink and the invisible organic components in the ink. This allows a direct comparison of the composition of inks being examined on the same TLC plate. To determine the relative concentrations of dyes present in the ink, the dyes separated on the TLC plate are scanned in a TLC scanning densitometer. The method is fast, reliable and inexpensive. High performance liquid chromatography (HPLC) has also been used for comparing inks with some success. Gas chromatography-mass spectrometry (GC-MS) is a very useful technique but the equipment is expensive. Method of chemical analysis

Equipment, materials and solvents . Merck HPTLC plates (silica gel without fluorescent indicator). The plates should be activated at 1008C for 15 min before use. . TLC scanning densitometer . Reagent grade pyridine, ethyl acetate, 1-butanol, ethanol, benzyl alcohol, DMSO, and water . 1 dram (1.8 g) glass vials with screw caps . 10 ml and 4 ml disposable micropipettes . TLC glass developing chamber to accommodate standard 4 in 6 8 in (10 cm 6 20 cm) TLC plates with cover . 20 guage syringe needle and plunger (the point of the needle must be filed so that the point is flat) . 10 ml and 20 ml automatic pipettes . temperature controlled oven Procedure . Using the syringe needle and plunger, punch out about 10 plugs of ink from the written line. . Place the plugs in the glass vial and add 1±2 drops of the appropriate solvent to the vial to dissolve the ink (usually pyridine for ballpoint ink and ethanol and water (1:1) for nonballpoint inks. Water resistant nonballpoint inks may require using pyridine or DMSO). Allow 15 min for the ink to dissolve.

593

. Note and record the color of the ink in solution and then spot the ink on to the TLC plate using the 10 ml micropipette. Keep the spots small by spotting intermittently and allowing the spots to dry between each spotting. . Repeat the above for all ink samples to be compared. Up to about 20 samples can be spotted on the same TLC plate. Be sure to analyze a sample of the paper with no ink as a control. . Place the TLC plate with the spotted inks in a temperature-controlled oven for approximately 10 min at 808C. Allow the plate to cool to room temperature then place the plate in the developing chamber using a solvent system of ethyl acetate:ethanol:water (70:35:30 by vol.). The solvent system should be allowed to equilibrate in the developing chamber for at least 15 min. . Allow the TLC to develop for 15 min, then remove it from the chamber and dry in the oven for approximately 15 min at 808C. . View the developed TLC visually and under ultraviolet light to determine which inks match in terms of the dyes and fluorescent components present. . Scan the plate in the scanning TLC densitometer to measure the relative concentrations of the dyes present in the inks. The dyes are scanned at 585 nm for blue and black inks if a spectrometer type densitometer is used. Video densitometers see all spots in shades of black and therefore no wavelength setting is needed for this instrument. (If the above solvent system did not adequately separate the dyes in the ink for accurate densitometer readings, repeat the tests using 1-butanol:ethanol:water (50:10:15, by vol.). . Compare the relative concentrations of the dyes present in the various inks. Failure at this point to detect any significant differences among the inks compared justifies a conclusion that all inks are consistent with being of the same formulation. This statement is based on the finding of no significant differences in the nondestructive tests and the chemical analysis. It should be noted that complete identification of an ink is not possible, because not all of the original ingredients in ink are present in ink dried on paper. . To identify the manufacturer and specific formulation of questioned inks, standard inks of known manufacture and formulation must be analyzed simultaneous with the questioned inks using the same procedures described above. To do this, however, requires access to a complete and comprehensive collection of standard inks and an analytical method that distinguishes each standard. The strength of any identification is only as strong as

594 DOCUMENT ANALYSIS/Ink Analysis

the completeness of the standard ink reference collection and the ability to identify its inks. . If the ink is properly identified, it is possible to determine from the manufacturer when that specific formulation of ink was first made. This may determine if a document was backdated. Although the above procedures are the most commonly used and have withstood the test of the courts for the comparison and identification of inks, other methods are available. For example, gas chromatography (GC) and GC-MS can be used to detect any volatile organic ingredients that might be present in the inks. HPLC can be used to detect volatile and nonvolatile components. Electron microscopy can be used to distinguish carbon from graphite, when these are present in inks. Time and the amount of ink sample available for analysis usually make the use of these techniques impractical.

by the Formulab Company since before 1970; however, the use of tags in their inks was discontinued in June 1994. Since the tags are considered proprietary information by Formulab, no further information about the tags can be reported here. Formulab should be contacted directly, if this information is needed. Ink dating tags are detected and identified by TLC using a solvent system of chlorobenzene and ethyl acetate (5:1, v/v). Standard samples of the tags should be run simultaneously on the same TLC plate as the questioned inks. The tags, if present, are viewed under longwave ultraviolet light and the RF values of the tags present in questioned inks are compared with the RF values of the standard tags. The dates the various tags were used must be obtained from Formulab.

Relative age comparison methods

Dating of Inks As mentioned earlier in this article, there is a huge demand for the dating of inks on questioned documents. Any time during an investigation when there is some question about the date of preparation of a document, an ink dating chemist is needed. Over the past 30 years, the ability to perform these examinations has become widely known and recognized among forensic scientists, document examiners and attorneys throughout the world. The ink dating procedures that will be described have passed the Frye and Daubert tests on numerous occasions and are therefore routinely accepted in US courts. Testimony has also been admitted using these techniques in Israel and Australia. First date of production method

After the ink is uniquely/positively identified, the first date of production of that ink or certain ingredients in the ink is determined from the manufacturer of that specific ink formulation. If the ink was not made until after the date of the document, then it can be concluded that the document was backdated. If the ink was available on the date of the document, then the document could have been written on that date. Ink tag method

If an ink tag is identified in an ink, it is possible to determine the actual year or years when an ink was made. Tags have been added to some ballpoint inks

Dating inks by this procedure is based on the scientifically proven premise that as ink ages on paper, there are corresponding changes in the solubility properties of the inks. Therefore, by comparing the solubility or extraction properties of questioned inks with known dated inks of the same formula on the same type of paper and stored under the same conditions, it becomes possible to estimate how long the ink has been written on the document. Two or more inks of the same formulation can be compared without known dated writings to determine whether the writings were made at the same or different times. This is only true if the inks being compared are still aging (drying), because after the ink has aged out (completely dry), no differences in solubility properties are expected, even if the inks were written at different times. Typically inks will become totally dry (as measured by these procedures) within 6 years; some inks become dry in less than 6 years. When two or more matching inks are compared without known dated writings, it is still possible to determine the sequence in which the inks were written. This again requires knowing that the inks are still aging and also knowing how the inks age. For example, some inks extract faster and more completely in organic solvents as the ink ages; whereas, others extract more slowly and less completely as they age. To determine which way the ink ages, a sample of the ink is heated at 1008C for 30 min. The rate and extent of extraction of this heated sample into an organic solvent is compared with an unheated sample of the same ink to determine if the heated (totally aged) sample extracted faster and more completely than the unheated sample, or vice versa.

DOCUMENT ANALYSIS/Ink Analysis

R-Ratio (rate of extraction) method and percent (extent) extraction method . Using the syringe and plunger, remove 10±15 plugs of ink and paper and place them into 1 dram glass vials. Cap and label the vial with the sample number. Repeat for each sample to be analyzed. . Set the timer to 10 min. . Using the automatic 20 ml pipette, add 20 ml of a weak solvent to the vial containing the ink sample and start the timer immediately. (For almost all ballpoint inks, 1-butanol is a good weak solvent.) . Stir by rotating the vial containing the ink and weak solvent immediately after adding the weak solvent and just before each aliquot is removed for spotting. . Spot 4 ml aliquots of dissolved ink in one continuous application on a TLC plate at 0.5, 1.5, 3 and 10 min intervals. Place these spots side by side at one end of the plate approximately 1 cm apart. (It may be necessary to use tweezers to remove the pipette from the vial.) Note: If a nonballpoint ink is being analyzed, it may be necessary to spot the 4 ml aliquots intermittently to prevent the spot from getting too large. The spot should be no larger than 0.3 cm in diameter . Repeat the above procedures for each sample to be analyzed. . Evaporate the solvent remaining in the vials in an oven at 808C (about 15 min). . Remove the vials from the oven and allow them to cool to room temperature. . Using the automatic pipette, add 10 ml of a strong solvent to each vial and allow to extract for 15 min. (Benzyl alcohol is the solvent of choice for ballpoint inks and some nonballpoint inks. Some nonballpoint inks may require using ethanol:water (1:1) or DMSO for water resistant nonballpoint inks.) . Spot 4 ml of the ink extracted with the strong solvent adjacent to the weak solvent spots. (If benzyl alcohol is used for the strong solvent, spot in one continuous application of the pipette to the plate. If pyridine is used, spot intermittently to keep the spot from getting too large.) . Repeat the above steps for each sample. . Dry the spots on the TLC plate at 808C for about 15 min. . Remove the plate from the oven and allow to cool to room temperature. . Scan the plate in the scanning TLC densitometer along the path of the four weak solvent spots and the one strong solvent spot and read the relative concentrations of the five spots. . Repeat the scan described above for each sample.

595

. Calculate the various R-ratios for each sample by letting the percent of ink extracted in the weak solvent at 10 min equal one. Then calculate the Rratios for each time interval of 0.5, 1.5, 3 and 10 min. This gives a normalized curve. . To obtain R-ratio curves, plot R-ratios vs. time of extraction (Fig. 1). Since all samples are being compared in the same manner, it is not necessary to correct for volume changes caused by successive aliquots removed from the vials. . Compare the R-ratio curves of all inks tested of the same formulation. To estimate the age of the questioned inks, compare the R-ratio curves of the questioned inks with known dated inks. . Calculate the percentage or extent of ink extracted in the weak solvent at the various time intervals, by dividing the reading for each weak solvent spot by the total amount of ink extracted in the weak and strong solvent, then multiply by 100. Figure 2 shows the amount of ink extracted in 10 min. A simplified percent extraction procedure can be performed by extracting each sample for just 1 min in the weak solvent, then after spotting this 1 min extract, the strong solvent is added directly to the weak solvent remaining in the vial. Then after allowing the strong solvent to extract for 15 min a second aliquot is spotted. This procedure produces just two spots to measure in the densitometer. Although Rratios cannot be determined by this procedure, accuracy and reproducibility of the percent extraction

Figure 1 R-Ratio curves (rates of extraction) for Bic black ballpoint inks written in 1992, 1994, 1996 and 1998. The matching curves for the 1992 and 1994 inks means that the ink became totally dry after 4 years, because there was no change in rate of extraction after this time.