Page 1
DOCUMENTAUTHENTICITY · A GUIDE FOR UK LAWYERS Detecting Backdated or Manipulated Documents The Forensic Examination of Documents That Claim a Date They Did Not Have COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM BACKDATING & ALTERATION DETECTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the forger controls the document, not its world 03 Internal evidence: metadata, anachronisms and the drafting signature 04 Format-specific exam in at i on: Office, PDF, images, scans and email 05 External corroboration: the estate the document should have inhabited 06 Alteration: detecting changes to an otherwise genuine document 07 Grading, reporting and deployment: from finding to consequence 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ABACKDATEDDOCUMENTFAILSONEOFTWOTESTS: ITS INTERNALEVIDENCEISINCONSISTENTWITHTHECLAIMEDDATE, ORTHEESTATEIT SHOULDHAVEINHABITEDDOESNOTCONTAINIT: ANDTHEEXAMINATIONRUNSBOTH, GRADESTHERESULT, ANDSTATESTHEALTERNATIVES
§ 02 · FIRST PRINCIPLES The problem in plain English: the forger controls the document, not its world
§ 03 · INTERNALEVIDENCE Internal evidence: metadata, anachronisms and the drafting signature
Page 2
§ 04 · FORMAT - SPECIFICEXAMINATION Format-specific exam in at i on: Office, PDF, images, scans and email
§ 05 · EXTERNALCORROBORATION External corroboration: the estate the document should have inhabited
§ 06 · ALTERATION Alteration: detecting changes to an otherwise genuine document
§ 07 · GRADINGANDDEPLOYMENT Grading, reporting and deployment: from finding to consequence
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION DOCUMENT THE ITSELF PLATFORM TRANSMISSION + BACKUP ENVIRONMENT CONTEXTUAL LAYER COUNTERPART Y LAYER RECORDS LAYER
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THESIDELETTERWITHA2023PRODUCERSTRING EXAMPLE2 · THEMINUTETHATWASASSEMBLEDFROMTHREELATERDOCUMENTS EXAMPLE3 · THEGENUINEINVOICETHATWASACCUSED
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORAUTHENTICITYEXAMIN AT ION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The authenticity checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can a backdated document really be detected if the forger changed all the dates? The other side says our document is fabricated because its file date is recent. What now? What if the document only exists as a scan or a PDF? How confident can an expert be that a document is forged? Can we tell whether a genuine document was altered after signing? Does this apply to emails and messages as well as documents?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Detecting Backdated Or Manipulated Documents, Computer Forensics Lab, https://e-discovery.uk/library/detecting-backdated-or-manipulated-documents/pdf.