Computer Forensics Lab, e-discovery.uk
e‑discovery.uk
Computer Forensics Lab eDiscovery
§ Guide

Detecting Backdated Or Manipulated Documents

This guide, 'Detecting Backdated or Manipulated Documents', provides a forensic exam in at i on of documents that claim a date they did not have.

Ref · E-D · 2026 · §LIBClass · ConfidentialJuris · England & WalesStatus · Active

Guide · 17 pages · 25 min read · Published 2026-08-31

This guide, 'Detecting Backdated or Manipulated Documents', provides a forensic exam in at i on of documents that claim a date they did not have. It covers internal evidence, including metadata, anachronisms, and the drafting signature, alongside format-specific exam in at i on for Office files, PDFs, images, scans, and email. The guide also details external corroboration, alteration detection, and the grading, reporting, and deployment of findings. It addresses common mistakes, technical limitations, and includes questions to ask and a checklist of red flags. This resource is essential for UK lawyers, in-house counsel, and investigators dealing with document authenticity, offering insights into how a specialist laboratory can assist in detecting backdated or altered documents.

Share
LinkedIn X / Twitter WhatsApp Email

Read this guide on your phone, browse guides by topic or go back to the full PDF library.

§ Credit and source

Published by Computer Forensics Lab on 2026-08-31. Original material of the practice, free to read, cite and download. The authority behind this subject is Forensic Science Regulator Code of Practice, digital forensics, which you should read alongside this guide. See every guide's author and source.

§ Full text of Detecting Backdated Or Manipulated Documents

Download the PDF

Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the wording shown here, including any later corrections.

Page 1

DOCUMENTAUTHENTICITY · A GUIDE FOR UK LAWYERS Detecting Backdated or Manipulated Documents The Forensic Examination of Documents That Claim a Date They Did Not Have COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM BACKDATING & ALTERATION DETECTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the forger controls the document, not its world 03 Internal evidence: metadata, anachronisms and the drafting signature 04 Format-specific exam in at i on: Office, PDF, images, scans and email 05 External corroboration: the estate the document should have inhabited 06 Alteration: detecting changes to an otherwise genuine document 07 Grading, reporting and deployment: from finding to consequence 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ABACKDATEDDOCUMENTFAILSONEOFTWOTESTS: ITS INTERNALEVIDENCEISINCONSISTENTWITHTHECLAIMEDDATE, ORTHEESTATEIT SHOULDHAVEINHABITEDDOESNOTCONTAINIT: ANDTHEEXAMINATIONRUNSBOTH, GRADESTHERESULT, ANDSTATESTHEALTERNATIVES

§ 02 · FIRST PRINCIPLES The problem in plain English: the forger controls the document, not its world

§ 03 · INTERNALEVIDENCE Internal evidence: metadata, anachronisms and the drafting signature

Page 2

§ 04 · FORMAT - SPECIFICEXAMINATION Format-specific exam in at i on: Office, PDF, images, scans and email

§ 05 · EXTERNALCORROBORATION External corroboration: the estate the document should have inhabited

§ 06 · ALTERATION Alteration: detecting changes to an otherwise genuine document

§ 07 · GRADINGANDDEPLOYMENT Grading, reporting and deployment: from finding to consequence

§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION DOCUMENT THE ITSELF PLATFORM TRANSMISSION + BACKUP ENVIRONMENT CONTEXTUAL LAYER COUNTERPART Y LAYER RECORDS LAYER

§ 09 · IN THE WILD Worked examples EXAMPLE1 · THESIDELETTERWITHA2023PRODUCERSTRING EXAMPLE2 · THEMINUTETHATWASASSEMBLEDFROMTHREELATERDOCUMENTS EXAMPLE3 · THEGENUINEINVOICETHATWASACCUSED

Page 3

§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations

§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORAUTHENTICITYEXAMIN AT ION

§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The authenticity checklist Red flags When to involve a digital forensic expert

§ 13 · COMMON QUESTIONS Frequently asked questions Can a backdated document really be detected if the forger changed all the dates? The other side says our document is fabricated because its file date is recent. What now? What if the document only exists as a scan or a PDF? How confident can an expert be that a document is forged? Can we tell whether a genuine document was altered after signing? Does this apply to emails and messages as well as documents?

§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER

§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY

§ Common questions

Frequently asked questions

Can a backdated document really be detected if the forger changed all the dates?
Usually: the dates are the easy part; the application build, fonts, features, revision identifiers and drafting signature inside the file (§3-§4), and the ladder, logs, recipients and backups outside it (§5), are the hard part, and forgers rarely manage all of them: Example 1 failed on its producer string, Example 2 on its revision IDs and empty world. The careful forger who ages the internals still cannot insert the document into last year's backups.
The other side says our document is fabricated because its file date is recent. What now?
Run the exam in at i on yourself, first: the recent date is usually a copy or export artefact (guide 108 §4, Example 3 here), and the platform record, the recipients' copies and the period backups will corroborate the true date: the party that proves authenticity holds the hearing. Demand the native and the corroboration through §11's requests if the accuser has them.
What if the document only exists as a scan or a PDF?
The scan carries the scanner's metadata and the PDF its producer's, both dateable (§4), and the external tests (§5) apply in full: where was the document sent, backed up, referenced? The absence of a native original where one should exist is itself a red flag; the paper original, if claimed, is examined by a questioned-document specialist under guide 100's matching.
How confident can an expert be that a document is forged?
As confident as the graded evidence allows (§7): "created no earlier than [date]" from an anachronism is near- certain; "absent from every expected store" is strong but circumstantial; "fabricated" combines both and excludes the alternatives. Honest reports state the grade and its basis; overclaimed ones are dismantled by the first innocent explanation the examiner failed to address.
Can we tell whether a genuine document was altered after signing?
Frequently: version diffs localise changes to rungs (§6), PDF incremental updates preserve prior states, digital- signature validity breaks on altered content, e-signature platforms record what was signed with its hash, and the counterparty's executed copy is the control: the alteration dated, localised and attributed where the evidence allows.
Does this apply to emails and messages as well as documents?
Yes, with format-specific tests (§4): header hops and message identifiers date an email's true transit; presence in server-side stores versus a lone copy in a produced file distinguishes the sent from the manufactured; and messaging platforms' server records (guides 63-66) corroborate or contradict the produced screenshot: guide 87's authenticity work, extended to every format the estate contains. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17
§ Related documents
Instruct the practice

Bring us in early. Defensibility is built, not retrofitted.

Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.

Open a confidential matter→+44 (0)20 7164 6971Direct lineinfo@e-discovery.ukEncrypted
WhatsApp