Detecting Backdated Or Manipulated Documents

DOCUMENTAUTHENTICITY · AGUIDEFORUKLAWYERS Detecting Backdated or Manipulated Documents The Forensic Examination of Documents That Claim a Date They Did Not Have COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM BACKDATING & ALTERATION DETECTION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the forger controls the document, not its world 03 Internal evidence: metadata, anachronisms and the drafting signature 04 Format-specific examination: Office, PDF, images, scans and email 05 External corroboration: the estate the document should have inhabited 06 Alteration: detecting changes to an otherwise genuine document 07 Grading, reporting and deployment: from finding to consequence 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : ABACKDATEDDOCUMENTFAILSONEOFTWOTESTS : ITS INTERNALEVIDENCEISINCONSISTENTWITHTHECLAIMEDDATE , ORTHEESTATEIT SHOULDHAVEINHABITEDDOESNOTCONTAINIT : ANDTHEEXAMINATIONRUNSBOTH , GRADESTHERESULT , ANDSTATESTHEALTERNATIVES § 0 2 · FIRSTPRINCIPLES The problem in plain English: the forger controls the document, not its world § 0 3 · INTERNALEVIDENCE Internal evidence: metadata, anachronisms and the drafting signature § 0 4 · FORMAT - SPECIFICEXAMINATION Format-specific examination: Office, PDF, images, scans and email § 0 5 · EXTERNALCORROBORATION External corroboration: the estate the document should have inhabited § 0 6 · ALTERATION Alteration: detecting changes to an otherwise genuine document § 0 7 · GRADINGANDDEPLOYMENT Grading, reporting and deployment: from finding to consequence § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION DOCUMENT THE ITSELF PLATFORM TRANSMISSION + BACKUP ENVIRONMENT CONTEXTUAL LAYER COUNTERPART Y LAYER RECORDS LAYER § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THESIDELETTERWITHA2023PRODUCERSTRING EXAMPLE2 · THEMINUTETHATWASASSEMBLEDFROMTHREELATERDOCUMENTS EXAMPLE3 · THEGENUINEINVOICETHATWASACCUSED § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORAUTHENTICITYEXAMIN AT ION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The authenticity checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Can a backdated document really be detected if the forger changed all the dates? The other side says our document is fabricated because its file date is recent. What now? What if the document only exists as a scan or a PDF? How confident can an expert be that a document is forged? Can we tell whether a genuine document was altered after signing? Does this apply to emails and messages as well as documents? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY