Alterations
Alterations
Alterations in Documents
27
SUSAN E. MORTON
BONNIE L. BEAL
Contents
27.1 Erasures........................................................................................................................320
27.2 Associated Evidence....................................................................................................324
27.3 Cutting.........................................................................................................................325
27.4 Interlineations and Additions ....................................................................................326
27.4.1 Sequence of Writing .......................................................................................327
27.4.2 Paper Condition and Sequence .....................................................................329
27.5 Obliterated or Overwriting ........................................................................................331
27.5.1 Overwritings and Insertions ..........................................................................333
27.6 Proof of an Unaltered Document .............................................................................333
27.7 Conclusions .................................................................................................................334
References .............................................................................................................................335
On numerous occasions documents are altered during their preparation or after their
completion with full knowledge of all parties concerned and without an attempt on the
part of anyone to perpetrate fraud. However, there are other instances — more numerous
than generally believed — in which an addition or other alteration is made with intent to
cheat some party in an otherwise fair and legitimate transaction. When such an act has
been committed, or is suspected, a document examiner may be consulted. Since these calls
for assistance are not infrequent, effective techniques have been devised through extensive
research and experimentation not only to disclose evidence of the alterations or additions,
but also to demonstrate what has been changed and what the original contents were.
Documents are changed in several ways, and each method requires a separate technique
for detection and for the restoration or decipherment of the original material. The most
common procedures include the removal of portions by erasure, obscuring the writing by
opaque marks, and the addition of material either by interlineation or by extending
portions of the document. Now we shall consider the more common problems in which
handwriting, typewriting, or printing has been removed from the document or expunged
in some manner. Under these conditions the ultimate objective is always to restore the
319
original writing so that it can be read in its entirety, but there are instances when only
portions can be deciphered.
27.1 Erasures
Figure 27.1 This image depicts a portion of a check that has been chemically washed. Small
remnants of ink from the previous original entry can be observed upon close inspection (top
image). The bottom image is the same area under IR luminescence. Remnants of the original
ink are not visible.
Figure 27.2 In this poor chemical wash portions of the original ink are still visible (upper
image). Under IR luminescence the original entries of “Shell” and “Fifteen and no/100” can be
seen.
Figure 27.3 The reverse side of the check depicted in Figure 27.2 is shown. Chemical staining
is evident.
be viewed microscopically or with IR lighting (Figure 27.2). Staining around the edges of
the check may be apparent as well under IR lighting (Figure 27.3).
Overwriting with a ball pen may not appear to be abnormal, but some evidence of
erasing probably will remain. Examination with oblique lighting, an electrostatic detec-
tion device (EDD), a microscope, photography, ultraviolet (UV) radiation, or IR lumi-
nescence should establish in most instances that there has been alteration. In contrast
to this, even very skillful erasures by means of abrasion or scratching generally leave
much more definite telltale traces consisting of disturbed paper fibers and portions of
the original strokes that were not completely removed. These erasures are consequently
more easily detected.
Although the first step is always to ascertain that an erasure has been made, in any
investigation of this nature the step that is of greatest importance to those who stand to
be defrauded by the alteration is the restoration or decipherment of the erased matter. By
restoration it is meant that the original writing is revealed on the document either tem-
porarily or permanently, while decipherment includes any method, photographic or oth-
erwise, that permits determination of what has been erased. Whether or not this is to be
successfully accomplished depends on both the original writing medium and the manner
in which it has been erased.
In the case of synthetic dye inks found in porous-tip or roller pens, bleaching removes
not only the color, but virtually all of the chemicals from the paper as well. Here again is
an example of the fact that non-chemical erasures, while more easily detected, are less
readily deciphered. With these inks, photographic techniques or examination under IR
imaging systems are standard methods, although not every erasure can be successfully
deciphered.
Carbon ink is very difficult to expunge completely. Chemicals do not bleach it, but an
abrasive erasure or a skillfully used knife edge or razor removes the ink effectively. Deci-
pherment of the original ink is usually extremely difficult. If it has been completely erased,
the problem may be virtually impossible. However, whenever there are some traces of the
original writing, these may be intensified photographically or digitally to bring about at
least a partial decipherment.
Ballpoint pen ink does not erase easily. Two papers that examined the erasable ball
pen ink were written by Peter Pfefferli and Jacques Mathyer 2 and William J. Flynn.3 Exten-
sive rubbing is necessary to effect a full erasure because the ink penetrates the paper and
is not all on the surface. Common chemicals can completely remove ballpoint pen ink
from paper,1 though this technique may leave the indentation of the ball track. Photo-
graphic, UV, and IR luminescence methods, while not foolproof, are the better ways of
deciphering the original writing.
The decipherment of erased pencil writing, regardless of whether a black, indelible,
or colored pencil was used, presents not only a difficult but also an arduous and lengthy
task. The erasure can be made with a soft rubber eraser, which in the hands of a skillful
person hardly disturbs the paper surface. Even so, except when the writing was executed
with a very light touch, slight indentations of the original strokes may remain after
complete obliteration (Figure 27.4), and when incomplete, some carbon or pigment
traces are to be found (Figure 27.5). Both the indentations and traces serve as the basis
of decipherment. Visual and photographic examination under controlled light, involving
both oblique illumination and low-intensity diffused light, are effective methods of
reading the erased matter.4 At times reflected IR illumination is needed and, with colored
pencils, IR luminescence.
Utilizing the imaging software with an IR imaging system is a great tool in deciphering
erasures and capturing the image for the case notes. EDD examination of both front and
back of the paper is often useful in deciphering abraded writing, or at least graphically
demonstrating that an erasure has occurred.
With indelible pencil writing some of the unerased dye can be made more visible by
moistening with a fine spray of alcohol.5 The alcohol dissolves the remaining fragments
of dye, causing them to spread, thereby reproducing the erased portion.
If during the erasing process the paper surface was badly roughed, the problem
becomes more complicated. Under favorable circumstances, a complete decipherment can
Figure 27.4 Impressions left of the initial number that was erased and then written over, as
viewed under oblique lighting.
Figure 27.5 Indentations of the original numeric amount are seen using oblique lighting.
Traces of the original graphite are seen at the bases of the 1 and 2.
be achieved, but there are many cases where only a part of the original matter can be read.
Should traces of the original matter remain, they may be intensified digitally with imaging
enhancement software or with an IR imaging system.
Computer-generated text may be easy or difficult to expunge, depending on the tech-
nology used to create it. Some inkjet inks are water soluble, though their removal in that
way will generally stain the paper. Toner such as laser printing can sometimes be scraped
off the page, but again, physical evidence will usually remain. The same techniques used
to decipher an erasure may be used here as well, but decipherment is usually very difficult.
When a lift-off ribbon has been used with a correcting typewriter, impressed outlines of
the letters usually remain. Virtually all of the pigment is removed, but the impression of the
Figure 27.6 An altered money order is illustrated. Image A shows a portion of the document
under normal lighting. Images B and C show magnification of the areas altered by cutting the
original portion of the document and replacing it with areas from another money order, in this
case the letters NI and a 9. Image D demonstrates the adhesive on the reverse side illuminated
with UV lighting.
27.3 Cutting
A rare, though not unheard of, alteration of a document can be achieved by skillful cutting
away of some portions and then inserting new material to fill the gap. Of course, it is
necessary to devise some means of securing the inserted material in place. The document
may be pasted to another sheet, or stamps or tape may be affixed to the back of the
document (Figure 27.6). Checkwriter imprints have been altered by this means. 7 Careful
inspection of the paper will reveal the alteration, but casual observers and even those who
handle the document in business transactions, businessmen and bank employees, have
been fooled by checks altered in this manner.
If the paper is thick, only the top layer need be cut out and the inserted material cut
so that it fits accurately into the depression. Contest cards and pari-mutuel tickets are
known to have been produced with key numbers modified in this way. 8 Detection of the
alteration is possible, of course, but what was there originally normally cannot be ascer-
tained.
Figure 27.7 The insertion of a sheet of paper is determined by the examination of the staple
holes. The top image is from the first page, the middle from the second, and the bottom from
the third. Notice the additional perforation between the two main staple holes (top and bottom
images). It was created when the end of the staple punched through the back of the sheets. The
perforation is not found on the second page, providing evidence that it was not in place at the
time the original stapling occurred.
put together in normal order — evidence that the sequence of intersecting writing strokes
or strokes across the folds or perforations in the paper is not in the logical sequence that
would be consistent with the natural or alleged preparation of the document.
Figure 27.9 Fluid ink that is fresh can be pulled along the line of a pen that passes over the
top. This spreading of the ink is seen under IR luminescence. This phenomenon may not be
visible if the second ink has a stronger luminescence, thereby masking the spreading of the
underlying ink.
by rubbing the back of the sheet with a warm tacking iron for about 5 seconds. At this
time there are a number of companies developing instruments and software to determine
line-intersecting problems. One paper that deals with one such instrument was written by
Veerle Berx and Jan De Kinder.12
Pencil-written intersections may contain evidence of continuous and interrupted stri-
ations or grooves in the two lines. Occasionally, the second line may drag particles of
pigment from the first line, a condition more readily observed if the two strokes are of
different colors. In fact, with any kind of intersection, if the second writing instrument
drags particles of pigment or dyes from the crossed line, this is significant evidence that
it was written last.
Several different considerations come into play when writing and printed text intersect.
With fluid ink crossing a relatively fresh typewriting or toner image, there is a tendency
for the water-based ink to be repelled by the oils and waxes or resin found in the typewriter
ink or toner. As a result, small gaps, a slight narrowing of the fluid ink line, or beading of
the ink can be observed. This same condition can occur when a fluid ink crosses a fresh
ballpoint pen line. Inkjet images will behave very much like fluid ink writing. If there is a
substantial interval of time between the preparation of the typewriting and the fluid ink
writing, no repelling may be observed since the oily materials in the typewriting have
completely dried out. Because of this complete lack of any repelling of the aqueous ink by
the typewriting, it is suggested that the typewriting was prepared first, but it is not a sure
indication of this fact. A rare phenomenon of the fluid ink spreading into completely dried
typewriting has been reported. This contradictory action is due no doubt to the disturbance
of the paper surface by the typewriting. There have been studies that show that when fluid
ink is written last across a toner line, the ink may penetrate the toner and absorb into the
fibers below.13
Ballpoint pen writing across typewriting can be recognized by the spectral reflection
revealed by low-angle illumination or somewhat more readily by vertical illumination of
the intersection.9 The lack of such reflection constitutes strong evidence that the writing
preceded the typewriting. If both the typewriting and the ballpoint pen writing emboss
the paper, the condition of the edges of the embossing may assist in confirming the order
of preparation. Again, the lift-off technique can be employed using a relatively weak, tacky,
removable pressure adhesive. This material lifts the typewriting except when covered with
writing at the intersection. The lifted image shows a continuous outline of the typewriting
except when it is covered by ink. The presence of a break in the typewriting is a clear
indication that the writing overlays the typewriting, but if there is no break at the inter-
section, then the opposite conclusion can be drawn.
A further indication that the writing is over the typewriting can be derived when
the typewriting embosses the paper and the pen stroke shows a skipping at the center
of the typewritten stroke where the pen failed to make contact with the paper in the
deepest part of the embossing. This condition is often accompanied by damage to the
edges of the typewritten stroke resulting from the pressure of the pen against the edge
of the typewriting.
Many of the examinations above can be used when viewing ink strokes intersecting
toner. One study conducted by Michelle Novotny13 demonstrates that some inks will bleed
through the toner and soak into the fibers below. Other studies are being undertaken to
determine sequence of toner and ink lines that do not intersect. 14,15 Both studies demon-
strate the differences in the toner particles when they are below or above inked writing.
Color Figure 27.10 (following p. 366) depicts the spectral reflectance, using coaxial lighting,
of fluid ink written over the top of toner.
Figure 27.11 The smooth, continuous line created by the aqueous ink stroke is seen where
it intersects with the fold. This is evidence that the fold was made after the ink was applied.
Figure 27.12 The paper was folded before the aqueous ink stroke was written. Note the
skipping and over-inking on the downstroke of the letter i.
worn fold in the paper spreads discernibly into the adjacent paper fibers in a manner that
immediately establishes that the writing followed the folding. A dried ink stroke that is
subsequently bent or broken by a fold is not affected in this way. Instead, it remains
unchanged, or with deep folds, the ink film may contain microscopic breaks. Ballpoint
pens may skip on the far side of a fold ridge or within the trough of a concave fold. There
are times when ink is rubbed off the ball housing at a fold intersection.
The sequence of fluid ink writing and a perforation follows a similar pattern. When
the perforations are put in the paper after the writing has been completed, both fluid and
ballpoint pen ink strokes are cleanly cut (Figure 27.13), but when the writer tries to write
Figure 27.13 The impression of a misaligned checkwriter cut through part of the signature.
The ridges of the checkwriter impression break some portions of the ink line, as seen in the
8, indicating that it was applied after the check was signed and raised.
across a perforation, the fluid ink is very apt to flow along the cut edge. With a ballpoint
pen, the ink does not flow, but the ball can catch in the perforation, staining the edges.
Sometimes the crowding or twisting of the writing reveals the writer’s effort to avoid the
perforation entirely.
Pencil and printed text strokes across folds and perforations may leave evidence of
sequence as well, but the demonstration of the facts is a more complex problem than with
ink writing and may be subject to greater limitations. With pencil and toner images, there
is no ink that can flow into broken paper fibers. Still, typical differences in the continuity
of the writing strokes or the ridge of a fold may allow definite conclusions, although not
in every case. With these problems, as with all questions of sequence, experimentation
under controlled conditions is often needed to verify that an apparent determination of
sequence is the correct conclusion.
Under proper circumstances, sequence can be definitely established through these
examinations, and the order is definitely fixed. The weight of this evidence can be great.
When an unusual sequence of writing is established from the physical facts, it is not in
itself positive proof of fraud. Rather, this physical evidence must be weighed in conjunc-
tion with the other testimony and facts in the case. The burden of proof generally shifts
to those who oppose this new evidence, for it becomes their task to establish that this
situation can exist without conflict with the intent or original purpose of the document.
Overwriting — that is, the obliteration or blocking out of portions of writing by some
opaque material — is seldom used for fraudulent purposes because of its obviousness.
Nevertheless, from time to time such obliterations may be encountered in all types of
documents. Many times the writer blots out writing simply by striking over it thoroughly
with the same writing instrument with which the document is written. The anonymous
letter writer may attempt to block out a printed return address on the only available
envelope.
These examples serve to illustrate the diversity of problems. Virtually each case has its
own ramifications, requiring various techniques and making difficult an accurate, generalized
forecast as to the measure of success. The solution at best is a tedious process involving
extensive experimentation, and it must be recognized that failures are to be encountered.
Successful decipherment or restoration depends principally upon the medium
employed for the original writing and the covering material. Three possible methods of
solution present themselves: (1) to penetrate the covering layer so that the original
writing lying beneath is revealed, (2) to remove the obliterating material chemically or
by some other means while the original writing remains untouched, and (3) to try to
decipher the impression from the original writing or typewriting that has not been
destroyed by the obliterating action.
Imaging methods can succeed if a difference in color or chemical composition exists
between the original writing and the covering material. Separation may be affected with
filters of a color similar to the obliterating substances, but this attack breaks down when
the covering is a true black. The use of an IR imaging system that is capable of transmitted
light, IR luminescence, UV radiation, and oblique lighting may enhance the chance of
differentiation success as well. It has been shown that in utilizing scanning and imaging
software, some inks may be differentiated. As a general rule, if complete and accurate
decipherment is to be achieved, the methods involve repeated attempts under slightly
different conditions.
When other methods fail, or are impractical, the obliterating material can sometimes
be removed or weakened by chemical or mechanical means. Success depends upon whether
the techniques employed affect only the obliterating substance, or at least have a more
pronounced effect on it than the writing beneath. Blue-black or aniline inks obliterating
carbon inks, pencil strokes covering inks, and many ink or pencil strokes hiding typewriting
are combinations that lend themselves to these methods of attack. Ordinary erasers and
common solvents that may affect writing inks when skillfully manipulated may achieve
the desired results. Thus, under favorable circumstances, this approach to the problem is
successful, but as the combination of materials that are not susceptible to this treatment
are numerous, success is far from universal.
One form of obliteration has rather widespread use today. This is the use of correc-
tion solutions or tapes in lieu of erasing, especially with typewriting. One technique is
to type through a correction ribbon or sheet covering the outline of the letters to be
retrieved. Usually, new typewriting is placed in the same area. The other technique is to
use liquid or tape correction material. These can be either painted on or placed over the
area to be removed. Again, new text can be written over the correction material. In most
instances a careful inspection will reveal the obliteration. Normally the original material
can be read by transmitted light (Figure 27.14) or by photocopying the back of the sheet
using color-tinted transparency film, so the image can be turned into a read right
position. When the correction material is too thick or there is interference from the
reverse side, the document may need to be immersed in petroleum ether, 16 or some of
the material may need to be removed for decipherment. A xylene substitute has been
found to be effective in removing most solutions with little or no detrimental effect to
the underlying ink.17,18 In some cases the only hope is that the opaquing material may
Figure 27.14 An obliteration made with opaquing solution is seen under normal lighting
(upper image). The bottom image shows the original number was a 2 when viewed from the
reverse side using transmitted light. (Courtesy of Jan Seaman Kelly.)
be faulty and some portions of the original writing may yet be discernible. These partial
strokes or weak outlines of semiobliterated letters can be intensified and deciphered. All
these obliterations by and large require a diversity of methods combining various tech-
niques, experimentation, perseverance, and often a full measure of luck to ensure ulti-
mate success.
the findings must be that no significant alteration has occurred that in any way would
change the intended purpose of contents of the document. It is the cumulative evidence
that establishes that the document is unaltered.
Therefore, depending upon how the document was prepared, the FDE must apply
those tests that are appropriate to establish that there has been no significant erasure, or
if there has been some minor erasure, that it is clear that such an act was merely to correct
an error, such as a misspelling, made in the preparation of the document. To accomplish
this requires the application of every appropriate test that could disclose the presence of
an erasure, and each must show negative results. It is the combination of these tests that
supports the conclusion that the document contains no erasures.
By the same token, tests that may reveal additions to the document must be considered,
such as those showing the use of more than one writing instrument, the addition of typed
or computer-generated text, or the insertion of material by an improper sequence of
intersecting lines or lines with folds or perforations. With a handwritten document, was
all the writing done with the same writing instrument and by the same writer, and is the
document free from evidence of undue crowding of key material? Thus, in dealing with
each specific page, the document examiner must be able to say that there is no evidence
that a word, sentence, or paragraph had been added.
A further consideration in a multiple-page document is whether any pages may have
been removed and others substituted, or new pages added into the document after execu-
tion. Such examinations, of course, involve consideration of the writing instrument,
printer, paper, manner of binding, and presence of writing indentations that may have
resulted from preparation of material on the previous page. There are the problems of
determining whether the entire document was prepared at one time in a continuous
manner, which involves considering the margins on page after page, the spacing between
lines, the manner of handling paragraphs, and, if handwritten, whether there is an abrupt
change in the quality of handwriting, which might suggest a different writing episode. In
this way the FDE should be able to show that no evidence is present that suggests or
establishes that the preparation of any page is inconsistent with any other pages.
Actually, an unaltered document is one that contains no erasures, no additions, and
no substituted pages. To establish this situation in a positive and definite manner involves
considering a great number of factors. There may be some instances even after considering
all the elements in which the FDE is unable to say positively that the document is unaltered,
but he or she can certainly point to the preponderance of the evidence that is inconsistent
with any change. Thus, the physical facts found within the document itself many times
govern just how positively this question can be answered.
27.7 Conclusions
Regardless of how a document is altered — whether it is by erasing, obliteration, or
insertion of new matter — it is vital to those who stand to be defrauded that all of the
evidence contained within the document itself be brought to light. The extent to which
this internal evidence can be extracted has been indicated and the limitations frankly
discussed. Despite occasional inadequacies, these techniques are more often potent tools
by which fraud can be revealed and, in a number of problems, the facts set forth.
The need to establish that a document has not been altered may involve a complex study.
There is no single, simple test. All potential tests for showing that something has been erased,
added, or modified in any way must be applied. When the combined results reveal no change,
it can be stated that there is no evidence to support that this document was altered.
References
1. Licht, G.A., Common chemicals for common criminals: check washing again, J. Am. Soc.
Questioned Doc. Examiners, 3, 65, 2000.
2. Pfefferli, P. and Mathyer, J., Eraser Mate un stylo a bille à encre effacable, Rev. Int. Criminol.
Police Tech., 4, 407, 1979.
3. Flynn, W.J., Paper Mate’s new erasable pen, J. Police Sci. Admin., 7, 346, 1979.
4. Hilton, O., Photographic methods of deciphering erased pencil writing, Int. Criminal Police
Rev., 85, 47, 1955.
5. Longhetti, A. and Kirk, P.L., Restoration and decipherment of erasures and obliterated or
indented writing, J. Criminal Law Criminol., 41, 518, 1950.
6. Casey, M.A. and Purtell, D.J., IBM correcting Selectric typewriter: an analysis of the use of
the correctable film ribbon in altering typewritten documents, J. Forensic Sci., 21, 208, 1976.
7. Harris, J.L., Eyeing the evidence, South. Calif. Alumni Rev., 21, 16, 1940.
8. Casey, M.A., Alteration of pari-mutuel tickets, J. Criminal Law Criminol. Police Sci., 62, 282,
1971.
9. Godown, L., Sequence of writing, J. Criminal Law Criminol. Police Sci., 54, 101, 1963.
10. Igoe, T.J. and Reynolds, B.L., A lifting process for determining the writing sequence of two
intersecting ball-point pen strokes, Forensic Sci. Int., 20, 201, 1982.
11. Godown, L., Recent developments in writing sequence determination, Forensic Sci. Int., 20,
227, 1982.
12. Berx, V. and De Kinder, J., The Application of Profilometry in the Analysis of the “Crossing
Lines” Problem, paper presented at the ASQDE Annual Meeting, San Diego, CA, August
14–18, 2002.
13. Novotny, M., Determining the Sequence of Original Ink Writing and Toner Printing, paper
presented at the ASQDE Annual Meeting, San Diego, CA, August 14–18, 2002.
14. Aginsky, V.N., Determining the sequence of non-intersecting media on documents: ballpoint
pen ink and laser toner entries, J. Am. Soc. Questioned Doc. Examiners, 5, 1, 2003.
15. Ezcurra, M., Differences between Toner Particles, above and below the Roller Ball and Gel
Ink Pen Entries, paper presented at the ASQDE Annual Meeting, Memphis, TN, August
22–26, 2004.
16. Lewis, J.A., Petroleum Ether Immersion: A Technique to Visualize and Photograph Correc-
tion Fluid Obliterations, paper presented at the ASQDE Annual Meeting, Ottawa, Canada,
August 25–29, 2000.
17. Licht, G.A. and Brown, J.L., Shandon Xylene substitute in document examinations, J. Am.
Soc. Questioned Doc. Examiners, 2, 94, 1999.
18. Beal, B.L., Removal of Opaquing Solutions from Documents, paper presented at the Amer-
ican Academy of Forensic Sciences Annual Meeting, Dallas, TX, February 16–21, 2004.
19. Hilton, O., Proof of an unaltered document J. Criminal Law Criminol. Police Sci., 49, 601,
1959.