Forensic Handwriting, Document Analysis, and Digital Evidence Techniques

What is the primary goal of forensic handwriting analysis, and how is it typically achieved?

The main goal is to determine the authorship of a questioned document. This is achieved by comparing the document to known samples (exemplars) and analyzing handwriting characteristics for unique, identifying features

.

List and briefly describe at least six of the twelve major handwriting traits that forensic analysts examine

Line Quality: Smooth vs. shaky or erratic strokes; Spacing: Distance between letters and words; Size Consistency: Uniformity in letter size; Continuous Writing: Whether the writing is fluid or interrupted; Connecting Letters: How letters are linked together; Letter Completeness: Whether all parts of letters are written fully

.

What is the difference between a questioned document and an exemplar? Why are both important in an investigation?

A questioned document is any writing with an unknown origin. An exemplar is a known writing sample from a suspect. Analysts compare the two to determine if the same person wrote them

.

Explain the difference between forgery and fraudulence. Provide an example of each.

Forgery is the act of creating or altering a document with the intent to deceive. Fraudulence is when forgery is used for material gain. Example: Signing someone else's name on a check is forgery, cashing that check is fraudulence

.

How has technology improved the accuracy of handwriting analysis? Name and describe at least one technological tool used.

Technology has improved objectivity and detection of subtle differences. Biometric signature pads record speed, pressure, and rhythm of signatures to detect forgeries

.

Describe at least three features or security measures used to detect counterfeit paper currency.

Watermarks visible under light; Security threads with embedded text; Color-shifting ink that changes color when tilted

.

What are some common methods used by criminals to commit check forgery?

Ordering checks using someone else's deposit slip; Altering the payee or amount on a check; Intercepting and modifying a check; Creating counterfeit checks from scratch

.

What are some of the limitations or challenges that forensic handwriting analysts face when presenting evidence in court?

Handwriting can be influenced by age, mood, or fatigue; Authentic documents may be altered; Analysts may miss subtle variations or lack sufficient exemplars

.

Describe how literary forgeries attempt to mimic historical documents. What materials and techniques might a forger use?

Forgeries may use old paper, chemically aged ink, historical writing tools, and authentic-looking watermarks to replicate historical documents convincingly

.

What role did handwriting analysis play in the Lindbergh kidnapping case, and how did that impact the field of forensic document examination?

In the 1930s, handwriting analysis helped identify the kidnapper through ransom notes. This case showcased the validity of handwriting analysis in criminal investigations and helped establish it as a forensic discipline

.

What is chromatography, and why is it used in science?

Chromatography is a technique used to separate the components of a mixture. It helps scientists analyze, identify, purify, or quantify the substances within that mixture

.

What are the mobile and stationary phases in chromatography?

The mobile phase is the liquid or gas that moves through the system carrying the sample. The stationary phase is the material that stays still, allowing separation based on each component's affinity to it

.

What forces allow paper chromatography to work effectively?

Capillary action and solubility. Capillary action moves the solvent up the paper, and solubility determines how well each dye dissolves and travels with the solvent

.

Name at least three types of chromatography and one unique feature of each.

Gas chromatography: uses a gas as the mobile phase; Liquid chromatography: uses liquid and solid beads in a column; Paper chromatography: uses paper as the stationary phase to separate ink or dye

.

How might a hospital use chromatography?

A hospital lab can use chromatography to detect and measure drug or alcohol levels in a patient's blood

.

Why must the ink dot be placed above the solvent level in paper chromatography?

To prevent the ink from immediately dissolving in the solvent. This allows the solvent to rise up the paper and carry the dye through capillary action for proper separation

.

Which dye in the experiment separated into blue and yellow, and what does this tell us?

Green dye separated into blue and yellow. This indicates it's a mixture of those two components, which have different solubilities and affinities

.

What happens if a component has a high affinity for the stationary phase?

It will move more slowly or not very far from the starting point because it is more attracted to the stationary material than the solvent

.

How does increasing the concentration of isopropanol affect dye separation?

Higher concentrations generally increase the solubility of dyes, allowing them to separate more effectively and travel further up the paper

.

What are some alternative substances and solvents that can be used in chromatography experiments?

Substances: markers, highlighters, flower pigments, food dyes; Solvents: methanol, ethanol, propanol, butanol

.

What role does a document examiner play in forensic investigations?

A document examiner analyzes questioned documents by comparing them to known samples to determine authenticity, origin, or if any alterations have occurred

.

Why is it important to use known writing samples when examining questioned documents?

Known writing samples serve as a baseline for comparison, allowing examiners to identify individual handwriting characteristics and determine authenticity

.

How do printing devices acquire individual characteristics over time?

Through wear and tear from regular use, which causes random and unique changes in mechanical parts, making each machine's output slightly different

.

What techniques are used to detect erased or altered writing in documents?

Techniques include microscopic examination, side lighting, and the use of infrared light to detect disturbances in paper fibers or different ink properties

.

What is the difference between visible and latent data on a digital device?

Visible data is actively recognized and accessible by the operating system, while latent data exists in places like RAM, file slack, or unallocated space and is not visible to standard system functions

.

Why is it important to avoid booting a suspect computer during forensic imaging?

Booting can alter or overwrite files, which might destroy valuable evidence— forensic imaging aims to capture all data without making any changes

.

What is a "digital fingerprint" in the context of forensic imaging?

It's a hash value (usually a 32-character alphanumeric string) that uniquely identifies the contents of a hard drive before and after imaging to confirm no changes occurred

.

What are the differences between physical and logical extraction in mobile device forensics?

Physical extraction copies all data bit-by-bit (including deleted files), while logical extraction only captures visible data the device normally shows to the user

.

What kind of data can mobile devices provide in a forensic investigation?

Call logs, messages, location data, internet history, app usage, and potentially deleted files—all of which can provide context or timelines related to a crime

.

How does hybrid crime assessment help investigators?

It helps tie together digital and physical evidence to create a clearer understanding of the crime, especially when digital devices are involved in traditional crimes

.

What is the difference between forgery and fraud?

Forgery involves creating or altering a document with the intent to deceive, while fraud involves using that forged document to gain something of value unlawfully

.

Why is a questioned document significant in forensic investigations?

Because its authenticity or source is in doubt, making it critical to determine whether it has been forged, altered, or otherwise tampered with

.

How does a clone differ from a backup in digital forensics?

A clone is an exact copy made on the same type of medium, while a backup might not include all data or system-level information and could be stored on a different medium

.

What type of threat does content spyware pose?

It allows unauthorized access to observe or record all activities on a computer, posing serious privacy and security risks

.

What is the role of the SIM card in mobile phone investigations?

The SIM card stores the IMSI (International Mobile Subscriber Identity), which ties the phone to a particular user and mobile network

.

Why is phishing considered dangerous in cyber investigations?

Because it tricks users into giving up sensitive personal information, such as passwords and financial data, which can then be used for identity theft or fraud

.

What is the function of a Faraday bag in mobile evidence collection?

It shields the device from radio frequencies, preventing remote access or tampering with data once the device is seized

.

What is the main benefit of a physical forensic image over a logical extraction?

A physical image captures all data on the device including deleted files and system-level information, providing a complete evidentiary snapshot

.

How does a worm differ from other types of malware?

A worm is self-replicating and spreads itself across networks without needing to attach to a host program, unlike trojans or viruses

.

Why can mobile forensic investigations be complex?

Because different devices and operating systems store and manage data in unique ways, requiring customized approaches for data extraction and analysis