Chain of Custody for Digital Documents: Making Evidence Hold Up
A forensic finding is only as strong as the custody story behind the file. Hashes, handling, and documentation — how to keep digital document evidence defensible.
How to Tell if a PDF Has Been Edited: 6 Checks That Actually Work
Six practical checks — from metadata dates to hidden revision history — that reveal whether a PDF was modified after it was created, and what each one can and can't prove.
The Fake-Document Economy: Inside the Template and Generator Industry
Pay stubs in 60 seconds, bank statements to order, "novelty" diplomas — an entire industry sells document fraud as a service. How the template economy works and what its products have in common.
The Document Forensics Glossary, in Plain English
Fifty-plus terms from PDF structure, image forensics and the signature world, defined for the person reading a forensic report rather than writing one — including what each one does not mean.
When Was This Really Made? A Field Guide to Document Time
Documents carry more clocks than people expect — and fraud usually breaks at least one. Where timestamps live, which ones lie easily, and how to read them together.
The Free Document Forensics Toolkit
ExifTool, pdfid, qpdf, mutool, FotoForensics and the rest — what you can genuinely establish about a suspicious document with software that costs nothing, in what order, and the four things free tooling cannot do.
What Fonts Give Away: Typography as Forensic Evidence
Every document has a typographic fingerprint — and edits break it. How font substitution, spacing drift, and impossible typefaces expose altered and backdated documents.
Reading Email Headers: The Trail a Message Can't Fake
Everything a sender types can be forged. Everything the relay servers stamped on the way through cannot be rewritten after the fact — which is why the headers are where the answer lives.
The Document Remembers: Recovering What a PDF Used to Say
Change a PDF and save it, and most software leaves the old version physically inside the new one. Sometimes the amount before the edit is still sitting there, waiting to be read.
OCR vs Document Forensics: Reading Isn't Verifying
OCR tells you what a document says. It has nothing to say about whether it's real. Why extracting a document isn't verifying it — and why you need both, in order.
EXIF Data: What a Photo Quietly Reveals About a Claim
A photo carries a hidden layer of data — when, where, and with what it was taken. How EXIF corroborates a claim or contradicts it, and why missing metadata isn't a verdict.
How to Tell if a Contract Was Altered After Signing
Two copies of "the same" agreement, one clause different. How to prove which version is real — from signature validation to word-level diffs and the PDF's own history.
Copy-Move Forgery: The Most Common Image Edit Nobody Notices
Cloning a region of the same image is the forger's favorite move — the borrowed pixels come pre-matched. How copy-move detection works, and where it shows up in documents.