Document Examination and Forgery Detection¶
Summary¶
This chapter covers the forensic examination of questioned documents, including handwriting, forgery, ink, and currency. Students learn the twelve structural characteristics used in handwriting analysis (line quality, slant, spacing, and others), exemplar collection protocols for both requested and unrequested writing samples, and the three forgery types: blind, simulated, and traced. Ink analysis is covered through paper chromatography and thin-layer chromatography (TLC) as techniques for separating and comparing ink components. The chapter concludes with counterfeit currency detection, including security features such as watermarks, security threads, and infrared-reactive inks. After completing this chapter, students will be able to analyze a writing sample across multiple structural characteristics and distinguish the three types of document forgery.
Concepts Covered¶
This chapter covers the following 15 concepts from the learning graph:
- Handwriting Analysis
- Handwriting Characteristics
- Line Quality in Writing
- Slant and Spacing Analysis
- Requested Writing Exemplars
- Unrequested Writing Exemplars
- Blind Forgery
- Simulated Forgery
- Traced Forgery
- Ink Chemistry Analysis
- Paper Chromatography
- Thin-Layer Chromatography
- Counterfeit Detection
- Currency Security Features
- Watermarks and Threads
Prerequisites¶
This chapter builds on concepts from:
Welcome, Investigators!
Documents carry two kinds of information: what they say, and how they were made. A forged signature still betrays the forger through tremor, hesitation, and unnatural pen lifts. A counterfeit bill still fails under ultraviolet light. Questioned document examination is the systematic comparison of physical evidence against known standards — and it turns out that nobody can perfectly fake someone else's handwriting. Follow the evidence — stroke by stroke.
The Science of Questioned Documents¶
A questioned document is any document whose authenticity, authorship, or origin is in dispute in a legal proceeding. Questioned documents include wills, contracts, checks, threatening letters, ransom notes, graffiti, typed documents, and currency. The forensic document examiner's role is to analyze the physical evidence — the ink, paper, handwriting, printing method, and structure — to determine authenticity and, where possible, authorship.
Questioned document examination draws on three major scientific disciplines: handwriting comparison (comparing characteristics of writing to known exemplars), ink and paper analysis (chromatographic separation of ink components), and security document examination (evaluation of currency and other protected documents against known security features).
Handwriting Analysis: The Foundation¶
Handwriting analysis in a forensic context is the systematic comparison of handwriting in a questioned document against handwriting in authenticated known samples, called exemplars. The goal is to determine whether the same person wrote both documents — or, sometimes, to exclude a suspect as the author.
Handwriting is a learned motor skill. When a person learns to write, they begin with the copybook forms taught in school. Over years of practice, each writer develops deviations from those standard forms — personal habits, shortcuts, and individual movements that become unconscious and automatic. These unconscious deviations are the basis for handwriting comparison.
Because handwriting is a habitual motor pattern, a skilled writer cannot easily fake another person's writing style. Attempting to copy someone else's writing forces the forger to consciously control movements that are normally automatic — and this conscious control leaves detectable traces in the physical evidence.
Handwriting Characteristics¶
Forensic document examiners analyze handwriting characteristics — the measurable, observable features of writing that can be compared between samples. These characteristics fall into two categories: class characteristics shared by people who learned the same style of penmanship, and individual characteristics — the personal deviations unique to a specific writer.
The major structural characteristics examined include:
Line Quality is perhaps the most diagnostically important characteristic. Line quality in writing refers to the smoothness, continuity, and pen pressure visible in a stroke. Authentic writing from a skilled writer produces smooth, flowing strokes with consistent pen pressure. Forgeries — particularly traced or slowly drawn simulations — often show tremor (small oscillations along the stroke), hesitation marks (pen lifts or pressure pauses where the forger stopped to check the model), and blunt starts and stops (where the pen was placed down and lifted rather than flowing naturally through the stroke). Line quality is difficult to fake because smooth writing requires unconscious, automatic motor control that forgers cannot replicate when consciously mimicking.
Slant and Spacing Analysis examines the angle at which letters lean relative to the baseline (the horizontal line on which text sits) and the consistent spacing between letters, words, and lines. A writer's habitual slant — forward (to the right), backhand (to the left), or vertical — is largely fixed and unconscious. Similarly, inter-letter and inter-word spacing reflects habitual motor habits. Slant is measured in degrees from the vertical; a difference of more than a few degrees between samples is significant. Spacing inconsistencies often appear in forgeries because the forger must concentrate on letter forms rather than spacing habits.
Pen lifts and connections — where the writer lifts the pen from the paper between strokes and which letters are connected — are highly individualized. Some writers connect letters that copybook style lifts between; others lift where connections are expected.
Letter formations — the specific shapes of individual letters, particularly the distinctive letters a, g, r, y, and f — carry individual characteristics. The number of strokes used to form a letter, the direction of each stroke, and retracing patterns all reflect individual habit.
Baseline alignment — whether writing drifts up, down, or stays level across a line — and pen pressure distribution (which parts of strokes receive heavier pressure) round out the set of characteristics that together constitute a writer's profile.
What Does the Data Tell Us?
Handwriting comparison produces one of three conclusions: (1) Consistent with authorship — the writing shares enough characteristics to suggest the same author; (2) Inconsistent with authorship — significant differences indicate a different author; (3) Inconclusive — insufficient sample size or quality to reach a determination. Document examiners do not claim absolute certainty; they assess probability based on the number and weight of matching and differing characteristics. The more characteristics that match across multiple samples, the stronger the conclusion.
Exemplar Collection: Known Writing Samples¶
A handwriting comparison is only as good as the exemplars — the authenticated writing samples used as the known standard for comparison. Two types of exemplars are used in forensic handwriting examination.
Requested Writing Exemplars¶
Requested writing exemplars (also called collected or dictated exemplars) are writing samples obtained directly from a suspect or person of interest at the request of investigators or examiners. The examiner dictates text for the subject to write, often including words and letter combinations from the questioned document. Requested exemplars are collected under controlled conditions: the subject uses the same type of writing instrument and paper as the questioned document; samples are collected in multiple sessions to capture natural variation; and the subject is not shown the questioned document (to prevent conscious imitation or avoidance).
Requested exemplars have a limitation: a subject who knows they are being compared to a questioned document may deliberately alter their writing — writing more slowly, changing slant, or using unnatural letter forms. This deliberate alteration is itself detectable (it introduces tremor and inconsistency), but it reduces the diagnostic value of the comparison.
Unrequested Writing Exemplars¶
Unrequested writing exemplars (also called course-of-business exemplars) are writing samples produced before the investigation, in the normal course of daily life — letters, diaries, business correspondence, school records, signed documents. These are the most valuable exemplars because they were produced without awareness of later forensic examination, so they represent the writer's natural, unguarded writing habit.
Investigators seek unrequested exemplars from multiple time periods and in multiple contexts (informal personal writing, formal business writing) to capture the natural range of the writer's style variation. A single signature is never sufficient for a reliable comparison; multiple signatures from different contexts are needed.
Forgery: Three Types¶
When someone produces or alters a document fraudulently, the physical method they used leaves characteristic traces. Three distinct methods of handwriting forgery are recognized.
Blind Forgery¶
Blind forgery occurs when the forger writes without directly copying or tracing the authentic signature or text — they produce what they believe the target writing looks like from memory, or they freely invent a plausible signature without any model. Blind forgeries are often the easiest to detect: without a model to copy, the forger relies entirely on their own motor habits, producing writing that reflects their own style rather than the target's. Characteristics such as letter formations, pen lifts, and slant will be those of the forger, not the target.
Simulated Forgery¶
Simulated forgery occurs when the forger attempts to copy the target's writing by looking at a model while writing — drawing each stroke slowly and carefully, observing the model, then reproducing what they see. Simulated forgery is more sophisticated than blind forgery but introduces characteristic problems: the forger's conscious, deliberate control of normally automatic movements produces tremor, hesitation marks, pen lifts in unexpected places, and retouching (going back to a stroke to correct or thicken it). Simulated signatures also tend to match the model's overall shape more than its dynamic quality — the proportions may look right, but the flow is wrong.
Traced Forgery¶
Traced forgery occurs when the forger places the authentic document under the questioned paper and traces the writing through the paper, or uses a light box to illuminate both layers. Traced forgeries can reproduce the exact shape of the original but are detectable by several indicators: indentation or embossing (visible with oblique lighting or electrostatic detection) from the underlying document, irregular pen pressure as the forger tracks the hidden line, tremor from the controlled tracing movement, and initial pencil marks or grid lines used to align the overlay.
Electrostatic Detection Apparatus (ESDA) is a technique that detects the indentation of writing from previous pages in a notepad — even if the original page has been removed. ESDA reveals embossed writing that is otherwise invisible under normal lighting.
Diagram: Handwriting Characteristics Comparison MicroSim¶
Handwriting Characteristics Comparison MicroSim
Type: microsim
sim-id: handwriting-comparison
Library: p5.js
Status: Specified
Learning Objective: Identify the key handwriting characteristics used to compare questioned and known writing samples (Bloom Level 1 — Remember; verb: identify).
Bloom Level: Remember (L1) Bloom Verb: Identify
Canvas layout: - Left panel (~50%): Display of a questioned writing sample (simulated handwriting) - Right panel (~50%): Display of a known exemplar writing sample
Visual elements: - Two side-by-side text panels showing simulated cursive writing of the same phrase - Annotated overlay markers that appear when the user clicks a characteristic - Characteristic panel at the bottom listing: Line Quality, Slant, Spacing, Letter Formation, Pen Lifts, Baseline
Interactive controls: - Buttons for each characteristic; clicking highlights that characteristic on both samples - Toggle button "Authentic / Forged" switches the questioned sample between a high-quality match and a simulated forgery (with tremor and hesitation marks visible) - Slider: "Magnification" zooms in on the selected characteristic
Data Visibility Requirements: - Show quantitative slant angle measurement when Slant is selected - Show color-coded highlights for matching (green) and differing (red) characteristics - Show a summary panel: "Matching characteristics: N / Differing characteristics: M"
Instructional Rationale: A Remember-level objective (identify characteristics) is best served by a visual comparison tool with labeled annotations, so students can recognize each characteristic before performing their own analysis.
Color scheme: Warm cream background for paper, dark ink for writing, blue highlights for characteristics, green/red for match/difference overlay.
Ink Chemistry Analysis¶
Even if two documents appear identical visually, the ink used to write them may reveal their true origins. Ink chemistry analysis examines the chemical composition of inks to determine whether two samples came from the same source — the same pen, the same ink batch, or the same manufacturing lot.
Modern writing inks are complex mixtures of colorants (dyes or pigments), solvents, resins, surfactants, and lubricants. The colorant composition of a ballpoint pen ink, for example, typically includes several dye compounds in specific ratios. Even inks that look the same color often have different dye compositions — a difference that chromatographic techniques can reveal.
Paper Chromatography¶
Paper chromatography is a separation technique used to identify and compare the dye components of inks. The technique exploits the fact that different chemical compounds move at different rates through a stationary phase (paper) when carried by a mobile phase (solvent).
Procedure: 1. A small sample of ink is extracted from the questioned document (typically by cutting a tiny disk of paper or swabbing with solvent) 2. The extracted ink is spotted onto a strip of chromatography paper at a defined baseline point 3. The paper strip is partially immersed in a solvent — the solvent wicks upward through the paper by capillary action 4. As the solvent front rises, it carries the dye components at different rates based on each compound's affinity for the paper (stationary phase) versus the solvent (mobile phase) 5. When the solvent front nears the top of the strip, the strip is removed and dried 6. Each dye component appears as a separate spot or band at a characteristic height
The position of each component is expressed as its Rf value (retardation factor):
An Rf value is reproducible for a given compound under the same solvent and paper conditions, allowing identification by comparison to reference standards.
By running the questioned ink and known reference inks on the same strip under identical conditions, the examiner can compare the Rf values and color of each separated dye band. A match in both Rf value and color suggests the inks are the same formulation; differences indicate different compositions.
Thin-Layer Chromatography¶
Thin-layer chromatography (TLC) is a more powerful version of the same separation principle. Instead of paper, TLC uses a rigid backing plate (usually aluminum or glass) coated with a thin, uniform layer of silica gel or aluminum oxide — producing a more consistent, reproducible stationary phase than paper.
TLC offers advantages over paper chromatography for ink analysis: - Better resolution: The uniform particle size of the silica gel produces sharper, more distinct spots - Visualization under UV light: Many ink dye components fluoresce under ultraviolet light even when invisible under white light, revealing additional spots not visible in the chromatogram under normal illumination - Larger compound library: Silica gel TLC has been extensively used for ink compound characterization; large reference databases of ink TLC profiles exist for comparison
For questioned document work, TLC with UV visualization is the standard analytical method for ink comparison. The examiner spots the questioned ink and multiple reference inks on the same TLC plate, develops the plate in an appropriate solvent system, and compares the patterns of separated spots under both white light and UV illumination. Matching patterns (same number of spots, same positions, same colors) supports a conclusion that the inks share the same formulation.
Investigator Tip
Ink analysis is not just used to detect forgery — it can also date documents. The FBI maintains the International Ink Library, a database of over 9,000 ink formulations with their introduction dates. If a document purportedly written in 1985 contains an ink formula not introduced until 1998, the document is fraudulent regardless of the handwriting. Always consider both the ink and the paper when examining a disputed document's age.
Diagram: TLC Ink Separation Interactive Diagram¶
TLC Ink Separation Interactive Diagram
Type: microsim
sim-id: tlc-ink-separation
Library: p5.js
Status: Specified
Learning Objective: Explain how TLC separates ink dye components for comparison, and interpret a TLC result as matching or non-matching (Bloom Level 2 — Understand; verb: explain).
Bloom Level: Understand (L2) Bloom Verb: Explain
Canvas layout: - Left panel (~40%): TLC plate visualization showing spotted inks, solvent front, and separated spots - Right panel (~60%): Controls and result interpretation
Visual elements: - Animated TLC plate showing solvent front rising from bottom to top - Dye component spots appearing and migrating as the solvent front rises - Multiple lanes: Questioned sample, Known Reference 1, Known Reference 2, Known Reference 3 - Rf value labels appear next to each spot when analysis is complete - Toggle: White Light / UV Light mode (UV reveals additional fluorescent spots)
Interactive controls: - Dropdown: Select questioned ink type (ballpoint, rollerball, gel pen, fountain pen) - Dropdown: Select reference inks for comparison lanes - Button: "Run Chromatography" — animates solvent front rise and spot migration - Button: "Toggle UV" — switches visualization to UV fluorescence mode - Button: "Calculate Rf" — overlays Rf value calculations
Data Visibility Requirements: - Show solvent front distance and component distances used to calculate Rf - Show color-coded match indicators: green checkmark when questioned Rf matches a reference; red X when it does not - Show a "Match Determination" panel: "Questioned ink matches Reference 2 formulation (3/3 components matched)"
Instructional Rationale: An Understand objective (explain TLC separation and interpret results) benefits from an animated, interactive chromatography simulation where students can run the separation and read the Rf comparisons themselves.
Color scheme: White TLC plate background, colored dye spots, blue solvent front, green/red match indicators.
Counterfeit Detection and Currency Security Features¶
Paper currency is among the most sophisticated protected documents in existence. Modern currency incorporates numerous security features specifically designed to make counterfeiting difficult and detection reliable. Counterfeit detection is the systematic examination of questioned currency against known security features to determine authenticity.
Forensic examiners use a combination of physical inspection, ultraviolet illumination, infrared imaging, and microscopic examination to evaluate currency. Each security feature exploits a physical or chemical property that is difficult or expensive to replicate with standard printing equipment.
Currency Security Features¶
Watermarks are intentional translucent patterns embedded into the paper during manufacturing by varying the thickness of the paper pulp. When held up to a light source, a watermark appears as a lighter-tone image embedded within the paper — not printed on its surface. In US currency, the watermark portrait (matching the printed portrait on the bill) appears to the right of center when the bill is held to light. Watermarks cannot be reproduced by printing because they exist in the paper thickness, not in the surface ink. Photocopied or inkjet-printed counterfeits produce only an approximation of the watermark by printing a faded image in the right area — visible as a surface image rather than a translucent internal structure.
Security threads are thin plastic or polyester strips embedded directly into the paper during manufacturing — running vertically through the bill. Modern US currency security threads are printed with microtext identifying the denomination and are visible as a dark vertical line when held to light. Under ultraviolet illumination, security threads fluoresce in denomination-specific colors: the $5 thread glows blue; $10, orange; $20, green; $50, yellow; $100, pink. This fluorescent response requires specialized inks that cannot be replicated with standard printing processes.
Color-shifting ink on US currency (most visible in the numeral in the lower right corner of $100 bills) shifts from gold to green (or green to black on older denominations) as the bill is tilted. This optically variable ink (OVI) contains metallic flakes with a coating that reflects different wavelengths at different viewing angles. Standard printing inks produce a single color regardless of viewing angle; color-shifting ink cannot be reproduced by photocopying or standard digital printing.
Microprinting is text so small (typically 0.2–0.3 mm in height) that it appears as a line or decorative element to the naked eye but reads as meaningful text under magnification. Microprinting in US currency includes the phrase "THE UNITED STATES OF AMERICA" around the portrait border and "USA 100" in the security thread. Photocopies lose microprinting resolution, producing a blurred line rather than legible text.
Intaglio printing is the raised-ink printing technique used for the portraits, numerals, and "FEDERAL RESERVE NOTE" on authentic currency. Intaglio inks feel slightly rough to the touch because the ink is applied at high pressure from engraved plates, leaving raised ridges. Offset and inkjet printing produce flat, smooth ink layers that lack this tactile feature.
Infrared and UV-reactive inks are incorporated into currency for machine authentication. Currency authentication devices in banks and retail use infrared sensors to detect the specific reflectance pattern of security inks and UV lamps to verify fluorescence patterns. The paper itself is treated with agents that prevent it from fluorescing under UV light — authentic US currency paper appears dark under UV, while most commercial papers used by counterfeiters glow bright white (they contain optical brighteners).
Red and blue security fibers are tiny strands of colored synthetic fiber distributed randomly throughout the paper during manufacture. These appear under magnification as short, colored threads embedded in (not printed on) the paper surface. Counterfeiters sometimes print simulated fibers — these appear as flat, printed lines rather than actual three-dimensional embedded fibers.
Watermarks and Threads: Detection Protocol¶
When examining questioned currency, the standard detection sequence is:
- Visual inspection — examine denomination, portrait, and overall printing quality; check for color-shifting ink
- Tactile examination — feel for intaglio print texture on portrait, numerals, and "FEDERAL RESERVE NOTE"
- Transmitted light — hold to light source; check watermark portrait position and security thread position
- UV examination — examine under UV lamp; authentic paper appears dark; security thread fluoresces denomination-specific color
- Magnification — examine microprinting legibility and embedded fiber structure
- Infrared imaging — use IR device to check security ink reflectance pattern
A genuine bill passes all six checks. A counterfeit typically fails at least one — most commonly UV examination (paper fluoresces), tactile (flat surface), or microprinting (blurred under magnification).
Common Mistake
Counterfeit detection pens — the iodine-based pens sold at retail — test only whether the paper contains starch, not whether the bill is genuine. Authentic US currency paper (made from cotton and linen, not wood pulp) contains no starch and produces no color change. However, a counterfeiter can wash the ink from a low-denomination genuine bill and reprint a high-denomination counterfeit on the now-starch-free authentic paper — which passes the pen test entirely. Pen tests are not reliable evidence of authenticity. Always use UV, transmitted light, and tactile examination together.
Key Concepts Review¶
The following table summarizes the major concepts from this chapter:
| Concept | Definition |
|---|---|
| Handwriting Analysis | Systematic comparison of writing characteristics between questioned and known samples |
| Line Quality | Smoothness and continuity of pen strokes; forgeries show tremor and hesitation marks |
| Slant and Spacing | Habitual angular and spatial patterns unique to individual writers |
| Requested Exemplars | Writing samples obtained directly from subject under controlled conditions |
| Unrequested Exemplars | Writing samples from normal daily activity; most diagnostically valuable |
| Blind Forgery | Forgery from memory without copying a model; reflects forger's own habits |
| Simulated Forgery | Forgery by copying model while writing; produces tremor and hesitation |
| Traced Forgery | Forgery using direct overlay tracing; detectable by indentation and unnatural pressure |
| Ink Chemistry Analysis | Chromatographic comparison of ink dye components |
| Paper Chromatography | Separation of ink components by capillary action through paper; measured by Rf values |
| TLC | Thin-layer chromatography; higher resolution than paper; UV visualization reveals additional components |
| Counterfeit Detection | Systematic examination of currency against known security features |
| Currency Security Features | Watermarks, security threads, color-shifting ink, microprinting, intaglio printing, UV-reactive inks |
| Watermarks | Paper-thickness variations visible by transmitted light; cannot be reproduced by printing |
| Security Threads | Embedded plastic strips with denomination-specific UV fluorescence |
Challenge: Forgery Classification
A handwriting examiner is given two documents: (1) a check signed with a name, and (2) a threatening letter. For the check, the examiner observes a signature with smooth overall letter shapes matching the authentic exemplar but with multiple tremor oscillations along strokes, hesitation marks at the start of each letter, and retouching on three letters. For the threatening letter, the examiner observes that the writing shares class characteristics with the suspect's exemplar but the specific individual characteristics (letter formations, pen lifts) consistently differ from the suspect's.
Classify the type of forgery on the check. What is the probable conclusion for the threatening letter?
Answer: The check signature shows simulated forgery — the forger copied the target signature while looking at a model (explaining why overall shape matches), but the conscious control of the normally automatic pen movements produced the characteristic tremor, hesitation marks, and retouching. These features are diagnostic of simulated forgery and are extremely difficult to avoid when copying writing deliberately.
For the threatening letter, the class characteristics match (same general penmanship style, same school of handwriting) but individual characteristics differ consistently. This supports a conclusion of inconsistent with the suspect's authorship — the letter was likely written by a different person who shares the same copybook penmanship style (perhaps educated in the same region or era) but has different personal writing habits. The examiner would report this as the letter being inconsistent with having been written by the named suspect.
Case Closed — For Now
From the tremor in a forged signature to the UV glow of a security thread, questioned documents carry the physical record of how they were made and who made them. You can now analyze handwriting characteristics, distinguish forgery types, interpret chromatographic ink comparisons, and evaluate currency authenticity. Chapter 15 shifts to the digital world — where forensic investigators recover evidence from phones, computers, and networks. Follow the evidence — even into the cloud.