13 Unit Notes Part 1

​Unit 13

Notes Part 1: Digital Forensics, Questioned Documents & Handwriting Analysis

​You will review slides and answer the questions.

3

Digital Forensics
A branch of forensic science that focuses on
identifying, acquiring, processing, analyzing, and
reporting on data stored electronically

4

1. Seizing the media.

2. Acquiring the media; that is,

creating a forensic image of the
media for examination.

3. Analyzing the forensic image of

the original media. This ensures
that the original media are not
modified during analysis and
helps preserve the probative
value of the evidence.

Digital forensic evidence involves a
three-step, sequential process:

Examines
structured
data with
regard to
incidents of
financial crime

$$$

Digital forensics is typically divided according to the type of devices involved. The major
branches are computer forensics, mobile device forensics, network forensics, forensic
data analysis, and database forensics.

Concerned
with evidence
found in
computers and
digital storage
media

Focused on
the recovery of
digital
evidence from
a mobile
device

Deals with
monitoring &
analyzing
computer
network traffic
for legal
evidence

Related to
databases and
their related
metadata
(large database
breaches)

Computer
Forensics

Mobile Device

Forensics

Network
Forensics

Forensic Data

Analysis

Database
Forensics

Branches of Digital Forensics

Even if someone is not a suspect in a
crime, courts can compel a person to
provide information to unlock a device,
with penalties of imprisonment, which
have been effective so far in cases in

which this has emerged.

GrayKey - device used by
law enforcement to crack
iPhone passcodes in a
matter of minutes for a
4-digit passcode.

Murdaugh Case:
No DNA, no blood, no fingerprints,
no weapon, but…
●Victim phone habits determined
approximate time of death

●Video from phone established
murderer was at the scene

●Infotainment system used to
refute alibi

●Step data from phone used to
question defendant

Multiple Choice

What is digital forensics?

• branch that focuses on electronically stored data

• branch that focuses on financial crimes

• branch that focuses on handwriting analysis

Multiple Choice

What is the first step in investigating forensic evidence?

• seizing the media

• acquiring the media

• analyzing the media

• all of these happen simultaneously

Multiple Choice

What is the last step in investigating forensic evidence?

• seizing the media

• acquiring the media

• analyzing the media

• all of these happen simultaneously

Multiple Choice

To acquire the media, the forensic investigator must make a direct copy of the media. What is the direct copy of the media called?

• forensic image

• binary image

• copy image

• direct image

Multiple Choice

What branch of digital forensics deals with recovery of evidence from a mobile device?

• mobile device forensics

• computer forensics

• database forensics

• forensic data analysis

Multiple Choice

Digital evidence is ONLY associated with cyber crimes.

• True

• False

Questioned Document
• Any document about which some issue has been

raised, or that is the subject of an investigation

– analysis in the physical and digital form

Examples of Questioned Documents

• Checks
• Licenses and Certificates
• Passports
• (Counterfeit) Money
• Receipts
• Lottery tickets
• Historical documents
• Ransom and notes

9

Document Examiners
• Examine handwriting to originate its source or authenticity
• Will also examine typed writings, and forgeries, and

decode altered and charred documents

• May need to use microscopes, photographs,

chromatography, and other lab examinations

• Many work in agency crime labs or privately

10

Multiple Choice

Which of these would NOT be a questioned document?

• lottery ticket

• receipt

• photo

• passport

Multiple Choice

Which of the following is NOT something which would be examined by a forensic document analyst?

• Will

• Passport

• Cardboard packaging

Multiple Choice

What does a document examiner do?

• examines handwriting

• can work in agencies or crime labs

• examines documents for forgeries

• all of these are correct

Multiple Choice

True or false: Questioned documents are compared to forged documents to identify a match in handwriting samples.

• True

• False

Handwriting Analysis
• General Information

– Two individual’s cannot have identical

handwriting

– Since handwriting is associated with

mechanical, physical, and mental functions, it
is almost impossible
to reproduce exactly

– Handwriting can

be almost as
individual as a
person’s fingerprint

11

Examining and Comparing

– A positive comparison must be based on an

ample number of common characteristics
between known and questioned writings

– Collecting a lot of exemplars (known writings)

is critical in order to make a comparison

12

– Exemplars should

contain some of the
same words or
combinations of
letters that are
present in the
questioned
document(s)

Forensic Information System of Handwriting
database (FISH)

– If the document is a part of a high profile case

or is suspected to be written by a repeat
offender, the document may be scanned into
the FISH database

– This database is maintained by the U.S. Secret

Service

– It can provide a list of “hits” based on

mathematical values calculated from the
scanned images, but a document examiner
makes the final confirmation or elimination

13

Multiple Choice

Document analysis is the examination and comparison of questioned documents with:

• newspaper articles

• known material

• any document you can find

Multiple Choice

An exemplar is ______________________________.

• an example of perfect handwriting

• a handwriting sample provided by a textbook

• a pre-written handwriting sample from a suspect

• a type of pen

Multiple Choice

What is the name of the handwriting system that was created by the Secret Service?

• FISH

• HARE

• BIRD

• DINOSAUR

Multiple Choice

Handwriting is an example of

• class evidence

• individual evidence

• direct evidence

1.Average amount of space
between words and letters

2. Relative height, width and size
of letters

• The height of letters including

the comparison of the height
of the uppercase and
lowercase letters

• The width of letters and the

space between letters and
words

• The size of letters relative to

the available space

14

The 12 Characteristics of Handwriting

3. Line quality – observing if the
lines are smooth, free-flowing, or
shaky and wavering

4. Connecting strokes –
comparing the strokes between
upper and lower case letters, and
the strokes between the letters
and the words

5. Beginning and ending strokes
– observing how the writer
begins and ends words,
numbers, and letters

15

6. Pen lifts and separations

• How the writer stops to form

new letters and begin words

• Forgeries may have lifts or

separations in unusual places,
such as within a letter

7. Shading and pen pressure – the
differing amounts of pressure
used by the writer that make lines
light or dark, narrow or wide
8. Baseline habits – analyzing if
the writer’s letters stay straight
or move up and down compared
to a baseline

16

9. Slant – analyzing the writing
slant: left, right, or straight

10. Unusual letter formation –
such as letters with tails or
letters written backwards, etc.

11. Flourishes or embellishments
– any fancy letters, curls, loops,
circles, etc.

17

12. Letter characteristics

• Completeness of closed characters

such as, o, e, and a

• Dotting of i and j, and crossing of t

Factors that can affect handwriting samples

– Writing instrument (pens, pencils, crayons, etc.)
– Writing surface (paper, wall, napkin, etc.)
– Underlying surface (smooth or rough)
– Mood of the writer (happy, depressed, angry, etc.)
– Age of the writer (undeveloped or shaky handwriting)
– Writing speed (slow or quick)
– Position of the writer (sitting or standing)
– Position of the document (flat, vertical, or horizontal

surface)

– Environmental exposure (temperature, humidity, etc.)
– Other factors

• Consumption of alcohol and/or drugs
• Injuries and/or illnesses

18

Multiple Choice

How many major categories are there for handwriting characteristics?

• 5

• 8

• 10

• 12

Multiple Choice

The handwriting on top is

• Sloped right

• Sloped left

• Slanted right

• Slanted left

Multiple Choice

If a person has writing that goes above and/or below the lines on the paper, this is referred to as which characteristic?

• baseline habits

• relative size

• spacing

• pen pressure

Multiple Choice

Which of these below illustrates the characteric of flourishes and embellishments?

Multiple Choice

Which one of these is not a characteristic of handwriting?

• continuity with the pen and paper surface

• type of pen or pencil used

• pen pressure

• slant

Multiple Choice

Which of these affects handwriting?

• The age of the writer

• The mood of the writer

• The writing instrument used

• All of these are correct