When examining a document, changes to the original content can occur in many ways. A person may erase handwriting, alter printed text, overwrite information, change the formatting of a digital document, or modify the appearance of existing content. Although these actions may sometimes produce a similar visual result, formatting is not the same as erasing.
In forensic document examination, it is important to distinguish between an alteration that changes the physical or digital appearance of a document and an alteration that actually removes or obscures existing information.
Understanding this difference is particularly important in questioned document cases, fraud investigations, document authentication, and digital evidence examination.
Erasing generally refers to the physical removal of writing, printing, or other marks from a document.
For example, a person may use:
In a traditional handwritten document, erasing can disturb the paper surface and remove or damage some of the original writing.
A forensic document examiner may therefore look for physical evidence of alteration, such as:
Even when the visible writing has disappeared, traces of the original information may remain.
Formatting is different from erasing. It generally involves changing the visual or structural presentation of information without necessarily removing the underlying information itself.
In a digital document, formatting may include changing:
For example, changing the font colour of a sentence from black to white may make the text appear invisible against a white background. However, the underlying characters may still exist in the document.
This is why formatting in digital forensics should not automatically be interpreted as deletion or erasure.
The simplest way to understand the distinction is:
Erasing attempts to remove or destroy information, whereas formatting generally changes how existing information is displayed.
Consider a handwritten document containing the word:
CONFIDENTIAL
If someone physically rubs the word with an eraser, the paper and writing may be affected. This is a form of physical alteration.
Now consider a digital document where the same word is still present but its font colour is changed to white.
The word may no longer be visible on the screen, but the underlying text can potentially remain within the document structure.
Therefore, these two situations may look similar to an ordinary viewer but are fundamentally different from a forensic perspective.
Yes.
Formatting can sometimes be used deliberately to conceal information.
For example, a person could:
However, hidden information is not necessarily deleted information.
A forensic examiner may examine the document’s underlying structure, properties, metadata, revisions, or other available artifacts to determine whether information remains recoverable.
This is one reason why simply opening a document and looking at what appears on the screen is not sufficient for a comprehensive digital document forensic examination.
When a document is suspected of being altered, the examiner first considers the nature of the evidence.
For physical documents, the examination may involve:
The objective is not simply to determine whether something “looks erased.” The examiner attempts to identify scientifically observable characteristics associated with the suspected alteration.
For digital documents, the examination can be considerably different.
The examiner may consider:
The exact examination methodology depends on the file type, software used to create or modify it, available evidence, and the circumstances of the case.
The distinction between formatting and erasing can become extremely important in cases involving:
Suppose an investigator receives a contract in which an important amount appears to have been removed.
At first glance, it may appear that the information was erased.
However, forensic examination could reveal that the text was not actually deleted. It may have been hidden through formatting, replaced with another object, covered by an image, or altered through another digital technique.
The forensic conclusion must therefore be based on examination of the available evidence rather than simply on visual appearance.
Not necessarily.
The presence of unusual formatting does not automatically establish forgery or intentional manipulation.
A document may contain different fonts, spacing, colours, or formatting because:
Therefore, an examiner should avoid making conclusions based solely on one unusual formatting characteristic.
A proper questioned document examination considers the totality of the available evidence.
Another important distinction is between physical erasure and digital deletion.
Physical erasure can leave physical damage or disturbance to the document surface.
Digital deletion, on the other hand, may involve removing data from a file, database, storage medium, or application. Depending on the technology and circumstances, deleted information may sometimes remain recoverable in other locations or artifacts.
This is where digital forensics and document examination can overlap.
Forensic investigators must understand that what appears to be “gone” from the user interface is not necessarily gone from the underlying evidence.
A forensic examiner generally looks for objective characteristics that can help determine what happened.
For a suspected physical erasure, the examiner may look for:
Surface disturbance → Paper fibre damage → Residual marks → Ink characteristics → Alteration patterns
For a suspected digital alteration, the examiner may investigate:
Visible content → File structure → Metadata → Formatting properties → Revision artifacts → Recoverable content
The examination should be conducted using appropriate forensic procedures while maintaining the integrity and documentation of the evidence.
The FBI Laboratory’s forensic science resources provide information about forensic laboratory disciplines, including forensic examination practices.
For additional information concerning forensic document examination and questioned documents, the American Society of Questioned Document Examiners (ASQDE) is another useful professional resource.
So, is formatting the same as erasing?
No.
Formatting generally changes the presentation or appearance of information, while erasing involves removing or obscuring existing marks or information. The distinction becomes particularly significant when examining digital documents because information that appears invisible or removed may still exist within the underlying file or associated artifacts.
From a forensic perspective, appearance alone should never be treated as conclusive evidence.
Whether dealing with a handwritten document, printed document, PDF, word-processing file, spreadsheet, or other electronic record, the examiner must determine what changed, how it changed, and what evidence remains of the original information.
This distinction makes understanding formatting vs erasing in forensic examination essential for investigators, forensic document examiners, digital forensic professionals, and anyone involved in the authentication of documents.
A photograph may look like nothing more than an image, but digitally it can contain much more information than what is visible to the human eye. Hidden within many image ...
Post comments (0)