This guide explains how to detect backdated or manipulated documents by examining internal evidence and external corroboration.
Guide · 17 pages · 25 min read · Published 2026-08-31
Designed for UK legal practitioners navigating disputed electronic evidence, this reference details how digital forensic examiners identify fabricated, altered, or improperly backdated electronic files. Although a forger controls the document itself, they cannot control the wider digital estate that the document ought to have inhabited. The text evaluates internal evidence including metadata, technical anachronisms, and drafting signatures across Microsoft Office files, PDFs, images, scans, and emails. It sets out methodology for detecting post-creation alterations to otherwise genuine records alongside external corroboration techniques that examine platform layers, transmission logs, backup environments, and counterparty records. Legal teams will find practical guidance on preparing CPR Part 35 expert reports, grading forensic findings from initial finding to legal consequence, spotting red flags using authenticity checklists, and formulating targeted questions for clients, opponents, and e-discovery providers. Incorporating real-world worked examples, common mistakes, and technical limitations, this material offers a structured framework for converting forensic analysis into persuasive legal outcomes before UK courts.
Read this guide on your phone, open the PDF reader with the full text, browse guides by topic or go back to the full PDF library.
17 pages · 25 min read
Detecting backdated or manipulated documents involves forensic examination of internal evidence, such as metadata and anachronisms, and external corroboration from the document's expected environment.
Published by Computer Forensics Lab on 2026-08-31. Original material of the practice, free to read, cite and download. The authority behind this subject is Forensic Science Regulator Code of Practice, digital forensics, which you should read alongside this guide. See every guide's author and source.
Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.
DOCUMENTAUTHENTICITY · A GUIDE FOR UK LAWYERS Detecting Backdated or Manipulated Documents The Forensic Examination of Documents That Claim a Date They Did Not Have COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM BACKDATING & ALTERATION DETECTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the forger controls the document, not its world 03 Internal evidence: metadata, anachronisms and the drafting signature 04 Format-specific exam in at i on: Office, PDF, images, scans and email 05 External corroboration: the estate the document should have inhabited 06 Alteration: detecting changes to an otherwise genuine document 07 Grading, reporting and deployment: from finding to consequence 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ABACKDATEDDOCUMENTFAILSONEOFTWOTESTS: ITS INTERNALEVIDENCEISINCONSISTENTWITHTHECLAIMEDDATE, ORTHEESTATEIT SHOULDHAVEINHABITEDDOESNOTCONTAINIT: ANDTHEEXAMINATIONRUNSBOTH, GRADESTHERESULT, ANDSTATESTHEALTERNATIVES
§ 02 · FIRST PRINCIPLES The problem in plain English: the forger controls the document, not its world
§ 03 · INTERNALEVIDENCE Internal evidence: metadata, anachronisms and the drafting signature
§ 04 · FORMAT - SPECIFICEXAMINATION Format-specific exam in at i on: Office, PDF, images, scans and email
§ 05 · EXTERNALCORROBORATION External corroboration: the estate the document should have inhabited
§ 06 · ALTERATION Alteration: detecting changes to an otherwise genuine document
§ 07 · GRADINGANDDEPLOYMENT Grading, reporting and deployment: from finding to consequence
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION DOCUMENT THE ITSELF PLATFORM TRANSMISSION + BACKUP ENVIRONMENT CONTEXTUAL LAYER COUNTERPART Y LAYER RECORDS LAYER
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THESIDELETTERWITHA2023PRODUCERSTRING EXAMPLE2 · THEMINUTETHATWASASSEMBLEDFROMTHREELATERDOCUMENTS EXAMPLE3 · THEGENUINEINVOICETHATWASACCUSED
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORAUTHENTICITYEXAMIN AT ION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The authenticity checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can a backdated document really be detected if the forger changed all the dates? The other side says our document is fabricated because its file date is recent. What now? What if the document only exists as a scan or a PDF? How confident can an expert be that a document is forged? Can we tell whether a genuine document was altered after signing? Does this apply to emails and messages as well as documents?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
17 pages · 26 min read
Spotlight indexes Mac files with extensive metadata, including origin and dates.
18 pages · 26 min read
Android photographs record when, where, and on what they were taken, similar to an iPhone's.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
