Email Headers in Digital Forensics
What Information Do Email Headers Contain? Introduction An email may look like a simple message containing a sender, recipient, subject, and timestamp. However, behind this visible information is a larger ...
Blog Mudita todaySeptember 23, 2026
A document may appear ordinary, but a small alteration in a signature, date, amount, stamp, or written text can sometimes have significant legal and financial consequences. When you suspect that a document has been forged or altered, it is important to preserve it carefully and avoid actions that could damage or compromise potential evidence.
Questioned Document Examination is a specialized forensic discipline used to examine documents for signs of alteration, forgery, erasure, additions, substitutions, and other irregularities. If a document is suspected to be forged, proper handling from the beginning can make forensic examination more effective.
Here are 10 things you should never do with a suspected forged document.
Never write notes, signatures, dates, arrows, numbers, or comments directly on a questioned document.
Even seemingly harmless markings can interfere with the examination of handwriting, ink, paper, printing, or other features. If you need to make observations, record them separately without touching the original document.
Physical damage can destroy important evidence.
Folding may create new creases, while stapling or punching holes can damage areas containing handwriting, signatures, stamps, or other impressions. Keep the document in its existing condition whenever possible.
If you notice a suspicious word, number, signature, or date, do not try to erase or correct it yourself.
An attempted correction can remove or modify important forensic characteristics. For example, an apparent alteration may contain evidence of overwriting, erasure, or different ink sequences that could be examined by a forensic document expert.
Avoid using water, solvents, ink removers, bleach, or other chemicals on a suspected forged document.
Chemical treatment can permanently alter paper and ink characteristics. It may also make subsequent ink examination more difficult.
If the document has already been exposed to liquid or chemicals, avoid further handling and inform the forensic examiner about what happened.
Lamination may seem like a good way to protect an important document, but it can interfere with forensic examination.
The covering material may prevent examination of the paper surface, impressions, ink characteristics, or other physical features. Therefore, a suspected questioned document should generally be examined before any permanent protective treatment is applied.
Repeated handling can introduce fingerprints, dirt, moisture, folds, and other unwanted changes.
Hold the document only when necessary and preferably by its edges. If it must be transported, use suitable protective packaging that prevents unnecessary contact and physical damage.
Guidance on preserving physical evidence can also be found through the National Institute of Justice.
A photograph or scanned copy can be useful for preliminary review, but it may not show all the characteristics present on the original document.
Features such as indentation, paper texture, ink distribution, sequence of strokes, erasures, and certain printing characteristics may require examination of the original.
Therefore, if available, preserve the original document for forensic examination rather than relying solely on a digital copy.
Keep the questioned document separate from unrelated papers whenever possible.
Documents stored together can rub against each other, transfer ink or debris, or become mixed during handling. Maintaining proper separation also helps preserve the original condition and chain of custody.
If several documents are associated with the case, identify and package them appropriately without writing directly on the evidence.
A document may look suspicious without necessarily being forged.
Differences in handwriting, ink, signatures, or printing can have legitimate explanations. For example, handwriting naturally varies, and signatures may differ depending on writing conditions.
A proper forensic handwriting examination considers multiple characteristics rather than relying on one visual difference.
A qualified forensic document examiner can examine the document systematically and report observations based on the available evidence. The American Society of Questioned Document Examiners provides information about questioned document examination and professional practices in this field.
Perhaps the most important rule is simple: never throw away a suspected forged document.
Even if the document appears obviously altered, it may contain valuable forensic information. The original can potentially help an examiner evaluate handwriting, signatures, ink, paper, printing, alterations, erasures, indentations, stamps, and other features.
Instead of discarding it, preserve it in its existing condition and seek appropriate forensic assistance.
The value of a questioned document depends not only on what is written on it but also on its physical characteristics and condition.
During Questioned Document Examination, a forensic expert may examine handwriting and signatures, alterations, erasures, additions, overwriting, ink characteristics, printing processes, paper features, stamps, and other relevant characteristics depending on the case.
Improper handling before examination can potentially damage or obscure some of these features.
If you suspect that a document has been forged or altered:
Written by: Mudita
Email forensics Neerav Jindal
What Information Do Email Headers Contain? Introduction An email may look like a simple message containing a sender, recipient, subject, and timestamp. However, behind this visible information is a larger ...
Copyright 2016-2025 all rights reserved by Hawk Eye Forensic.
Post comments (0)