Please read the following two article How to Keep a Digital Chain of Custody,( https://www.csoonline.com/article/2118807/how-to-keep-a-digital-chain-of-custody.html ) and (2) Forensic Document Analysis (excerpts)] and answer the questions below of the articles.

Excerpts from:

Forensic Document Analysis: DNA and Beyond

By James D. Cooner, CFE, M.B.A

What is a "Document?" First of all, what is a "document?" We are all familiar with various accounting documents, financial instruments, and the like. Any kind of letter or note is obviously a document. But what about "Redrum," scrawled on a mirror with lipstick? Or barely visible marks written on the palm of a hand? Or a cattle brand? Are those documents?

Yes. A document is any fixed means of communication. The Ten Commandments chiseled on stone tablets would be a document, but Native American smoke signals would not.

Questioned Document Examination Traditional forensic document analysis is more appropriately called "questioned document examination." Questioned document examination evaluates authorship and authenticity. Document examination does not reveal age, sex, physical characteristics, personality traits, or other personal information about the writer. For those characteristics, consult a psychic hotline.

Real questioned document examination includes determination of whether or not a disputed signature was executed by a suspect, or whether or not a suspect wrote a particular document. In some cases, document examiners may be able to provide additional information, but authenticity and authorship are the main goals.

The examiner uses objective handwriting characteristic criteria, including all of the physical movements used to write, to evaluate written materials. These examinations involve not only visual evaluation, but also detailed and meticulous hand-glass and microscopic examination. The examiner also uses subjective methods, including the examiner's training and experience to form an expert opinion as to the origin and authenticity of the document in question.

The questioned document is first analyzed internally, and then compared to other writings of known authorship and authenticity. These known documents are called standards.

When making comparisons, the examiner must do an "apples to apples" comparison. In other words: cursive writing to cursive writing, printing to printing, numbers to numbers, etc. In cases where exactly the same words and phrases are not available in standards, a much greater volume of standards and much more analysis will be required to develop an accurate opinion.

In making comparisons, document examiners use two types of standards. In many cases, it is possible to obtain non-requested standards. Non-requested standards are items written during the normal course of events, rather than upon request from an investigator. These standards are very valuable because they were written in a non-stress environment, without any thought to their being used later. Therefore, non-requested standards are usually most typical of the subject's normal handwriting. The downside of non-requested standards is that they may not contain exactly the words and letter combinations the examiner is looking for, and therefore, the examination will require a greater volume of standards.

The other type of standard is requested. Requested standards are dictated by the investigator, and the subject is asked to write exactly the words requested. The benefit of these standards is that they give an exact "apples to apples" comparison. The downside is obviously that the subject may attempt to disguise his writing to foil the investigation. In fact, qualified examiners estimate that 80% of their subjects attempt to disguise requested standards. If that attempted disguise is detected, however, the fact that the subject attempted to mislead the investigators may be damning evidence of criminal intent.

Normally, document examiners will request at least 25 requested standards, or as much non-requested standard material as is available.

Document Examination Opinions The objective handwriting characteristics in the questioned document are compared to those in the known standard, and an opinion is formed. The opinions may range from positively identified, to highly probable, to probable, and through the continuum to positively eliminated.

In evaluating expert testimony, it is important to understand what a document examiner means by "probable," for example. It is natural to equate "no opinion" with a 50-50 chance, "probable" with a 75% chance, "highly probable" with a 90% chance, and "positive ID" with 100% certainty, but that is not what the examiner means. A conservative document examiner will always give an opinion that is less definitive than what they know to be true. There is a difference between what they know and what they can testify to in court.

If a well-trained, well-qualified, conservative document examiner offers an opinion that a subject "probably wrote" a document, they wrote the document. However, there may be something about either the evidence or the standards available that does not permit the examiner to say that with absolute certainty. "Positive ID" does mean 100%, but for most conservative examiners, "probable" means something like 95%+, and "highly probable" means 99.5%+.

Another thing to understand about document examiners' opinions is that if you get opposite opinions from two different document examiners, something is profoundly wrong. Opposite opinions just do not happen between honest, well-trained examiners.

One document examiner may call a case "highly probable," while another rates it "probable," you might get a weak "probable" from one examiner and a "no opinion" from another. Those scenarios are just a function of one examiner being a little more conservative than another.

But if you see "probably did" and "probably did not" on the same case, one examiner is either a) incompetent, or b) "biased" - to be extraordinarily kind. You need to be aware that there are examiners who will do everything they can to make their opinion coincide with the interests of their client. Ethical examiners are conservative and "call 'em as they see 'em."

How Do I Select a Qualified Document Examiner? If you need to hire a document examiner, this is the most important question you need to answer, and in order to make the right decision, it is important to understand that there are document examiners...and there are document examiners.

A well-qualified document examiner should offer all or most of the following qualifications:

A degree in one of the hard sciences (chemistry, physics, biology, etc) or criminal justice (criminology, forensic science, etc.)...not psychology, sociology, anthropology, English literature, etc.

Intensive, long-term, structured training by a federal, state, or local law enforcement agency; two years is the standard training period

Extensive experience in forensic document examination, including expert witness certification.

Strong references from clients who have successfully used their services in the past, including testimony

What about "certifications?" There are professional organizations, including some fine groups, which offer certifications. Some certifying organizations require excruciating proof of competence. But there are others where the only criteria for certification is your check clearing the bank. As in our profession, organizations run the gamut from highly ethical to outright frauds.

As with any other profession (fraud examiners, accountants, lawyers, etc.) document examiner certification alone is no guarantee of proficiency. There are extraordinarily well-qualified document examiners who have spent their entire careers in law enforcement, but are not certified by anybody. Former FBI examiners, in particular, feel that if their work was good enough for the Bureau, it should be good enough for anybody...a perfectly sensible viewpoint. There are others who have an endless string of letters after their name, but are totally incompetent.

Rather than playing the certification game, we recommend the following strategy in hiring a document examiner:

Call your local law enforcement agencies and ask for a referral. Call the crime laboratory first (if they have one), then their fraud unit (if they have one), and then their detective bureau (if they do not have a fraud unit). Some local law enforcement agencies not only have well-qualified examiners, they let them do outside civil work. If they do not have examiners, they use someone from outside - either a state laboratory or a private examiner. Their department policies may prohibit them from giving you a direct referral, but they can point you in the right direction.

If that fails, try state and federal law enforcement agencies. In the federal system, the FBI, U.S. Secret Service, and U.S. Postal Inspection Service use document examination extensively. They may be able to refer you to one of their retired agents who is a well-qualified document examiner.

Check with local attorneys to see who is well-regarded in your community. Document examination is used in a wide range of legal actions, and most qualified document examiners are well known to local attorneys.

When you have some candidates, due diligence is key. You must do, a thorough job of qualifying your expert; your whole case may rest on this selection. You should do the following, as an absolute minimum:

Start by asking the candidate about their entry-level training. This will tell you more about their ability than any other single factor. What you are looking for is a minimum of a 1 - 2-year internship in a local, state, or federal law enforcement agency. If they start talking about certification and experience, rather than their initial training, be wary. If they trained under someone in private practice, ask how long the training was, and what the training of the trainer was. If the training is not what you are looking for, look elsewhere.

Ask if they are qualified as an expert witness in local courts.

Ask if they can offer expert testimony as to authorship and authenticity of handwriting. Do not be too impressed if they say yes - everybody says yes.

Ask if they can evaluate personality and other personal characteristics from handwriting. If they say yes, move on to another candidate.

Ask for references from attorneys. Ask the attorneys not only about the quality of their work, but also about their effectiveness as witnesses.

Document Examination Beyond Handwriting Modern document examiners have broad abilities in addition to the traditional authorship and authenticity determinations. They can, for example:

Detect alterations, erasures, and obliterations.

Resurrect evidence deteriorated by fading or decomposition.

Recover entire documents, or portions of documents, from underlying pages which were present when the original document was written.

To analyze documents further, examiners use cutting-edge technology, including the following:

Other Evidence From Documents There are at least two other important types of evidence that can readily be developed from many documents. One is fingerprints and the other is DNA.

Fingerprint Evidence There are two kinds of fingerprints: patent (visible) and latent (invisible). An example of a patent print would be one left by a greasy or bloody hand. You would be able to see the print.

By definition, latent fingerprints cannot be seen. Latent fingerprints are left behind by the natural oils on our skin. Only the outermost portion of our skin actually makes contact with objects, and on our fingers that means the ridges of our fingerprints. The oil on those ridges transfers to the object, leaving an invisible mirror image of the intricate pattern on our fingertips.

The normal method of recovering fingerprints from skin is the magna-brush. Microfine iron filings are dusted onto the skin. For some reason, these iron filings adhere better to the oils than graphite powder, and a clear print is often revealed.

Documents, of course, are another problem entirely. Documents are generally paper, which is absorbent, causing the oils to soak into the paper, which will not allow fingerprint powder to adhere to the oils. Or, if it does, the result will be an ugly smudge rather than a readable print. And all that is true. However, as we have seen, graphite powder is not the only way of developing latent fingerprints.

Summary In closing, documentary evidence can be crucial to your case. In determining the authenticity and authorship of a document, be sure you are extremely careful in selecting an expert to do the document examination.

And, do not just look for traditional evidence from a document. Remember that there is a lot more there than meets the naked eye.

Article Question:

Documentation Articles Questions From "Digital Chain" Article

(1) What is the "chain of evidence" for digital evidence taken from a hard drive (i.e., what's the difference between "best evidence" and additional copies)? From "Forensic Document Analysis" Article

(2) How is "document" defined? What are some things examinations can and can't reveal about a document? From a legal standpoint, what about a document examination is relevant or irrelevant?

(3) In addition to determining the authorship and authenticity of a document, what other broad abilities do document examiners have?