Page 1

DOCUMENTAUTHENTICITY · A GUIDE FOR UK LAWYERS Detecting Backdated or Manipulated Documents The Forensic Examination of Documents That Claim a Date They Did Not Have COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM BACKDATING & ALTERATION DETECTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the forger controls the document, not its world 03 Internal evidence: metadata, anachronisms and the drafting signature 04 Format-specific exam in at i on: Office, PDF, images, scans and email 05 External corroboration: the estate the document should have inhabited 06 Alteration: detecting changes to an otherwise genuine document 07 Grading, reporting and deployment: from finding to consequence 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ABACKDATEDDOCUMENTFAILSONEOFTWOTESTS: ITS INTERNALEVIDENCEISINCONSISTENTWITHTHECLAIMEDDATE, ORTHEESTATEIT SHOULDHAVEINHABITEDDOESNOTCONTAINIT: ANDTHEEXAMINATIONRUNSBOTH, GRADESTHERESULT, ANDSTATESTHEALTERNATIVES

§ 02 · FIRST PRINCIPLES The problem in plain English: the forger controls the document, not its world

§ 03 · INTERNALEVIDENCE Internal evidence: metadata, anachronisms and the drafting signature