A questioned document is any piece of writing, printing, or recorded communication whose authenticity, authorship, or content is in dispute. The label is broader than most people expect: it covers paper records like wills, checks, and contracts, but also anonymous letters, passports, medical records, graffiti, and digital files. Whenever someone challenges who created a document, when it was created, or whether its contents remain in their original form, it becomes a questioned document and a candidate for forensic examination.
What Turns a Document Into a Questioned One
A document earns the label the moment a genuine challenge attaches to it. That challenge usually falls into one of a few patterns. A signature looks forged. The author of a handwritten note is unknown. Text appears to have been erased, overwritten, or added after the fact. Or the physical materials themselves raise suspicion, such as ink or paper that doesn’t match the date the document claims.
Fraud is not a prerequisite. Sometimes a document is questioned simply because its origin is unclear, like an unsigned note recovered at a crime scene. Sometimes routine due diligence in a business transaction calls for independent verification before anyone signs off. The forensic process looks the same regardless of why the dispute arose.
Common Types of Questioned Documents
Wills and contracts sit near the top of the list. Heirs challenging an estate or business partners fighting over a deal often allege that a signature was forged or a clause altered after signing. Checks and other financial instruments draw scrutiny when a dollar amount or payee name appears to have been changed. Anonymous letters, including ransom notes and threatening messages, come in so examiners can try to identify the writer through handwriting features.
Beyond those, forensic examiners regularly handle:
- Deeds and property records
- Medical records
- Passports and identification cards
- Insurance claim forms
- Voter registration forms
- Job applications and employment paperwork
- Graffiti, when investigators want to link spray-painted text to a specific person
- Digital files, where embedded metadata can confirm or contradict a document’s claimed origin
Any material carrying written or printed communication can be a questioned document if the circumstances justify the examination. The format is less important than the dispute.
Known Documents and Exemplars
A questioned document on its own is only half the picture. Examination almost always depends on comparing the disputed item against reliable reference material, known in the field as “known documents” or “exemplars.” Without them, there is nothing to anchor the analysis to.
Exemplars come in two forms. Collected specimens are documents the person produced during ordinary life: signed checks, old letters, filled-out forms, medical intake paperwork. Because they were written without any thought of future examination, they tend to show the writer’s natural habits. Requested specimens are writing samples an investigator asks someone to produce on the spot, often by dictating text for the person to copy under controlled conditions.
Examiners generally want at least 15 samples to see the full range of a writer’s natural variation, and they prefer samples produced around the same time as the questioned document, since handwriting drifts over the years. Originals matter more than photocopies, because copies strip out pen pressure, subtle ink color variation, and the indented impressions a pen leaves on the page.
What Examiners Look At
Once a document is in the lab, the examiner picks from a toolkit built around what’s actually in dispute. Handwriting comparison studies letter shapes, slant, spacing, and pen pressure. Signature verification looks at whether a disputed signature falls within a person’s authentic range of variation; forgeries often fail by being either too perfect, which suggests tracing, or inconsistent with how the person normally signs.
Ink analysis uses chromatography and spectroscopy to break down ink chemistry, which can show whether different inks appear on the same page or whether an ink formula fits the document’s claimed date. Paper analysis examines watermarks, fibers, and physical traits to identify a manufacturer, estimate age, or detect pages swapped into a multi-page document. For machine-produced documents, examiners can sometimes trace output to a specific printer, typewriter, or copier through font quirks, toner patterns, or mechanical wear.
Specialized lighting, including infrared and ultraviolet, exposes erasures, overwritten text, and chemically bleached areas that the eye cannot see. An Electrostatic Detection Device recovers indented writing: the faint impressions left on a sheet of paper that sat beneath the one someone wrote on. Digital documents bring their own methods, since electronic files carry metadata on authorship, creation dates, editing history, and the device that produced them.1National Institute of Justice. Forensic Examination of Digital Evidence – A Guide for Law Enforcement
How the Answer Comes Back
Forensic document examiners do not deliver a flat “real” or “fake” verdict. They work along a standardized scale of confidence recommended by the Scientific Working Group for Document Examination (SWGDOC). From strongest to weakest, the positive conclusions run: identification, strong probability, probable, indications, and no conclusion.2SWGDOC. SWGDOC Standard Terminology for Expressing Conclusions of Forensic Document Examiners
An identification means the examiner has no reservations that the same person wrote both the questioned and known samples. Strong probability means the evidence is very persuasive but some critical quality is missing. Probable means the evidence leans fairly strongly toward common authorship without reaching virtual certainty. Indications means only a few significant features agree. No conclusion is the zero point, where limiting factors like disguised handwriting or thin comparison material prevent any lean at all.2SWGDOC. SWGDOC Standard Terminology for Expressing Conclusions of Forensic Document Examiners
The scale works symmetrically going the other direction, from “indications did not write” through “probably did not write” and “strong probability did not write” up to “elimination,” which is the mirror of identification. This vocabulary exists because investigators, attorneys, judges, and jurors need to know exactly how confident the examiner is. A “probable” finding carries very different weight than an “identification,” and collapsing that distinction into yes-or-no would misrepresent the evidence.
One boundary worth knowing: handwriting comparison is not infallible. Published error-rate research shows false positives and false negatives do occur, with higher error rates when examiners offer qualified opinions and higher still when samples come from twins.3PNAS. Accuracy and Reliability of Forensic Handwriting Comparisons The field is useful but not perfect, which is part of why the conclusion scale is graded rather than binary.
If You Have a Document You Think Will Be Questioned
If you suspect a document has been forged or altered and expect it to end up in front of an examiner, how you handle the physical item matters. Well-meaning actions can destroy the exact evidence an examiner needs.
- Do not write on the document or mark it in any way. A small notation in the margin can obscure relevant ink or indentation evidence.
- Avoid stapling, folding, or paperclipping it. Physical damage compromises paper fiber analysis and indented writing recovery.
- Store the original in a protective sleeve or envelope, kept away from heat, moisture, and direct sunlight. Ink and paper both degrade in poor conditions.
- Keep a written record of everyone who handles the document and when. Opposing counsel will test any gap in the chain of custody.
- Give the original to the examiner, not a photocopy. Copies lose pen pressure, ink color variation, and indented impressions, which are often the most revealing evidence in the case.
Also start gathering exemplars early. If authorship is the dispute, the examiner will need genuine samples of the suspected writer’s handwriting from around the same period as the questioned document, and the more the better. Collected specimens from everyday life carry more weight than samples produced after the dispute began, because they were written without any awareness that someone would later study them.