Chapter 19
IN THIS CHAPTER
Understanding handwriting analysis
Identifying forged and altered documents
Analyzing paper and ink
Looking into typewriters and copiers
It has been said that the pen is mightier than the sword, and when it comes to criminal enterprises, this statement often applies. Think about the embezzler who alters a company’s books so that he can get away with a large sum of money. Or an altered check, lottery ticket, or will. A critical analysis of any of these documents can be key to solving a crime.
The examiner uses all his skills, his experience, and several microscopic, photographic, and chemical analytic methods to tackle these tasks.
No two people write alike. Similarities may exist, but on close inspection, writing varies from person to person in notable ways. An individual’s writing style is personal and unique and results from unconscious, automatic actions. You don’t think about how you write, but only about what you’re writing.
This innate variability that everyone has is the bane of document examiners. If they’re to compare two samples of handwriting, they must consider this natural variability.
When examining handwriting, the forensic document expert is concerned only with the physical characteristics of the writing and not with determining the writer’s personality type. The latter is the job of a graphologist, and graphology is not an accepted forensic science.
A handwriting examiner needs several standards, or writing samples, to get a feel for a person’s writing style and determine whether that person wrote the questioned document. Complicating matters, standards may have been written with a different instrument and under different circumstances. So comparing a questioned document to a known writing sample on a wall may be impossible.
If no usable nonrequested standards (samples that already exist and are known to be authentic) are available, the examiner asks the suspected writer to provide a writing sample, using a similar writing instrument on similar paper, so that the examiner can at least establish a requested standard.
Handwriting styles aren’t static throughout our lives, so examiners try to obtain writing samples from documents written by suspected authors at about the same time as the questioned document. Say that an examiner is asked to determine whether a 20-year-old, handwritten will is authentic and was indeed written by the supposed author. The examiner needs to see other documents written by the supposed author from 20 years ago because those documents reflect his style at or near the time the will was prepared better than documents written just weeks before the examination.
The major advantage of requested writing samples is that no one questions their authenticity. The examiner actually watches the person write. The examiner also can dictate exactly what the individual writes, even a passage taken directly from the questioned document, so that the examiner can compare the samples word for word. If the document contains information that the examiner wants to withhold from the suspect or that is sensitive to an ongoing investigation, the person providing the sample can be asked to write sentences that are quite different but include many words and phrases that were used in the questioned document.
Suspects may also try to disguise their writing style on purpose, not wanting the handwriting sample to match the writing on a forged will, ransom note, or other questioned document. Unfortunately, these attempts to alter writing styles are sometimes successful, making getting a match difficult or impossible.
When beginning the comparisons between two handwritten documents, an examiner looks for points of similarity and points of difference between the known standards and the questioned document. The examiner typically assesses the following features:
Astute examiners look for all of these features when comparing documents or signatures. No single feature makes an accurate comparison, but a combination of features may enable examiners to determine whether suspect and sample writings came from the same person, which ultimately is a subjective judgment. However, based on the findings, examiners may say that the documents
Not every examination ends in an answer: The examiner may also say that a determination based on the samples is not possible. That outcome isn’t too common, though. If the writing in question is cursive (with the letters joined) or a signature, a trained examiner usually can usually determine whether a particular individual created it. If, however, the questioned document is printed, this task is much more difficult because many of the distinguishing features of cursive writing aren’t present in printed text.
Fortunately for law enforcement officials, most criminals aren’t that clever, which is something that often becomes evident in written documents, where misspellings are common. Forensic document examiners use these mistakes to their advantage. When suspected writers of forged documents or ransom notes are asked to produce requested samples for comparison, examiners usually ask them to use the same words that were misspelled in the questionable document. More often than not, if a suspect is the author of a questionable document, any misspellings are also seen in the requested writing.
As is true for fingerprints, firearm rifling patterns, and DNA, several handwriting databases exist. The FBI maintains the “National Fraudulent Check File,” the “Bank Robbery Note File,” and the “Anonymous Letter File.” Examiners can compare some questionable documents with these reference files. High-tech files, like the Forensic Information System for Handwriting (FISH), also exist. FISH contains scanned and digitized documents that officials can compare with other similar documents. Forensic document examiners visually check any matches.
Even the most careful and gifted forgers leave behind evidence of their efforts. Examiners inspect documents not only with the naked eye but also view them under a microscope, which often reveals telltale signs of forgery.
Two of the more common methods of forgery are freehand simulation and tracing. Freehand simulation simply means attempting to copy a signature or handwriting sample, and tracing involves placing another document over an original signature and tracing its lines. Each technique leads to various defects in the writing, and an examiner can identify them as the result of forgers writing in a manner that’s unnatural. Perfectly matching someone else’s writing style is not an easy task.
Another special form of forgery is disguised writing, a deception in which writers attempt to camouflage their own writing. Many ransom notes and threatening letters are written this way in hopes that the author can deny ownership at a later date. Suspects sometimes attempt to disguise their writing when confronted with an incriminating letter they foolishly wrote in their natural handwriting. Check out the earlier section “Obtaining standards” for more information about how criminals try to hide their handwriting.
Forgers often attempt to remove, add, or change portions of written documents for widely varied reasons that range from financial gain to creating an alibi. Alterations can be as simple as changing a date or as complex as attempting to erase and rewrite signatures or portions of documents. These changes are called erasures, obliterations, and alterations.
Text that doesn’t suit the criminal’s needs may simply be erased using a rubber eraser, a knife point or other sharp instrument, sandpaper, or even a fingernail — anything that scrapes or rubs away unwanted marks. You often can easily see erasures with the naked eye, but even when alterations aren’t readily apparent, forensic examiners have the following investigative tools at their disposal:
Exposing erasures is important because, even if the examiner can’t see the original words or marks, erasures reveal that someone altered the document, which in and of itself may be proof of a crime and render many legal documents null and void.
One way to destroy a document is to obliterate the paper on which it’s written. Criminals typically use fire for this purpose. After the paper burns, the writing is lost forever, right? Well, not exactly. If the paper is charred but still intact, reflecting light at various angles off the paper’s surface might expose the contrast between the ink and the charred paper background. The page then can be photographed.
Criminals sometimes use chemicals, such as oxidizing or bleaching agents, to remove writing. These chemicals react with ink by producing a colorless compound, and the writing disappears. Well, it almost disappears. Using a microscope, an examiner may see remnants of the ink and even a discoloration in the area where the paper was treated.
Using a laser is another modern method of obliterating writing. Although the laser vaporizes the ink, it also burns nearby paper fibers, and the damage shows up under a microscope.
Often, a simple obliteration of words or marks doesn’t completely serve the forger’s needs, so further alteration by replacing obliterated words or numbers with others is required. Common examples are changing the amount of a check or the date on a contract or will. Whenever someone obliterates writing before adding changes, an examiner can see the changes in the underlying paper and analyze the new writing by comparing it with the old for differences in technique. Sometimes, the forgery is so well done that a simple inspection doesn’t reveal any changes. Fortunately, the examiner has other tools in his bag of tricks.
Under the microscope, subtle differences between the original and altered portions of the writing may appear. Slight changes in ink color, line thickness, and pen pressure, as well as double lines, often become visible. If the forger used a ballpoint or roller ball pen, distinguishable marks from defects in either type of pen point may show up.
Overwriting is another form of forgery in which the forger doesn’t erase anything but rather adds to or overwrites a portion of a document. Maybe a 1 is changed to a 9, or a 0 is added to a check. If the forger uses the same ink that was used to prepare the original document, these types of changes can be extremely difficult to uncover. But forgers don’t often have access to the pen or ink that was used for the original writing, so they make do with a similar pen and ink color. Careful examination of the differing ink might reveal areas that have been altered.
You’ve seen it in movies, and it happens in real life. The criminal scrawls a ransom note, then tears away the note and doesn’t give a second thought to the page underneath. Later, police collect the pad of paper and submit it to the document examiner, who exposes the writing, thus proving that that particular pad was the source of the ransom note. The owner of the pad then has a bit of explaining to do.
The movement of a pen over a page indents the second page along the path of the pen, creating indented writing. Unlike what you’ve seen on TV, forensic technicians don’t use the old pencil method (rubbing a pencil over the paper to expose the indentions) to uncover indented writing, because the pencil’s markings may damage or destroy the evidence.
Sometimes, a simple angled light reveals indented writing. When it does, the technician photographs the page. A more sensitive method is the use of an electrostatic detection apparatus (ESDA), which can sometimes uncover indented writing several pages below the original page.
Sometimes, forensic document examiners must determine whether pages have been added to a document or whether the document actually was created at a particular time. In either case, the examiner may resort to analyzing the paper and ink that were used to create the document.
The types and amounts of each of these additives vary among manufacturers and paper types, and chemical testing can distinguish one type and manufacturer from another.
Another distinguishing characteristic of paper is its watermark, which is a translucent design on the paper that you can see by holding the page up to a light. This design indicates the manufacturer, the date of its production, and often for whom the paper was manufactured. Attempts to forge a watermark usually are easy to spot because true watermarks have fewer fibers than the rest of the page. Forged marks, however, actually are added images and thus have an underlying fiber density equal to the rest of the page.
Sometimes, the key to determining authenticity of a document lies in the ink that the writer used. Inks that appear the same, physically, may be much different, chemically. This distinction helps the examiner determine whether the same ink was used for each page or word of a document and may even help reveal whether a particular ink existed at the time the document supposedly was prepared.
One nondestructive method of ink comparison is called microspectrophotometry (see Chapter 17). This process enables the examiner to accurately determine whether the colors of the two inks match by comparing their light transmission, absorption, and reflection characteristics.
The distances that all of the inks migrate along the strip are determined by the respective sizes of their molecules. This process separates the inks into bands. Whenever inks from two pages of a questioned document are tested and they yield different bands, the writing on the two pages was done with two distinctly different inks.
Not only do pen and paper leave behind clues about the origin of a document but various mechanical devices do also. Typewriters, printers, and copy machines often leave distinguishing marks on the typed or copied page. These marks may reveal that a document has been altered or help investigators find out exactly which machine produced the document in question.
People frequently use typewriters to write threatening letters and ransom and extortion notes. Criminals often are under the mistaken impression that doing so makes the letter untraceable. Not true. When a typewriter is involved, the document examiner tries to
To determine whether a particular typewriter produced a questioned document, examiners search for individual characteristics that can include misaligned or damaged letters, abnormal spacing before or after certain letters, and variations in the pressure applied to the page by some letters. For example, certain letters can have telltale nicks or spurs that are imprinted on the page, or they can lean to one side or print slightly higher or lower than the others. These defects can be compared to a sample from a suspect typewriter and thus offer powerful individualizing characteristics.
To compare a typed document to a particular machine, the examiner types a comparison document using that machine. When doing so, the examiner uses a ribbon similar in type and condition to the one used to produce the original document. The reason: A worn or lightly inked ribbon reveals minor defects in the typeface, whereas a heavily inked, new ribbon may obscure them.
Typewriters that use ribbons can help the examiner link the typewriter to the document. If the typewriter has a single-pass ribbon and the same ribbon that was used to type the document still is in place, the police can simply read the message from the ribbon itself. Even if the ribbon has been used for several passes, investigators may be able to retrieve portions of the message.
What if the criminal used the original typewriter to add a line or a paragraph to a document? How does an examiner know when that has happened? Because the typeface would be identical, the examiner may not be able to tell whether an alteration occurred. However, when a page is placed into a typewriter a second time, the alignment often is off, and although it may only be slightly askew, the examiner can place a specially made glass plate with an etched grid pattern over the page. This reveals any imperfection in the alignment of the added lines or paragraphs.
Investigators can sometimes match a photocopied document to a particular copy machine because the mechanisms within the machine that pull the paper onto and remove it from the copy surface can leave marks on the page. Likewise, the cover glass, camera lens, or drum may have scratches or defects that mark every page that it produces. Occasionally, these marks appear on a photocopied page, and investigators can identify and match this marked page to the machine that produced it.