The Power of Digital Forensics for Document Authentication

Has there been a situation in a case where a Microsoft Excel document didn’t have expected financial data? Was there ever a Will or other documentation in probate that did not seem to fit the verbal wishes of the deceased individual? Perhaps a dispute over when an email was sent or when a calendar appointment was created? All of these situations can be solved through digital forensic analysis and appropriately classified as Document Authentication.

What is Document Authentication?

Document Authentication, or specifically Electronic Document Authentication, is the analysis of electronic media to confirm facts, such as origin, composer, timestamps, and more. Media of all types contains metadata that may be of use in internal investigations, criminal proceedings and civil court cases. Some typical examples of sources of evidence that can be used for computer forensics documentation include Microsoft Office documents, E-mails, various financial invoices, images, audio/video recordings, and much more.

Why is Document Authentication relevant?

Unfortunately, when attempting to authenticate a file, it is not as easy as looking at the “apparent metadata” of the file. Any of the metadata mentioned above can be manipulated relatively easily by malicious tools designed to display incorrect data. Even typical use of a computer can change the dates and times of a file in such a way to mislead those without a trained eye or Expert experience. If you unsuspectingly rely upon this information as “gospel”, you may find that you are at a disadvantage.

Enter the Expert

So what value can an Expert provide when a potential digital document authentication issue is looming? An Expert has the knowledge and ability to navigate various artifacts and piece together insight regarding suspect files. In order to provide such insight, an Expert may review system metadata, internal metadata, artifacts of system clock manipulation, the existence of time-stomping tools, and the existence of editing software, among other locations that may hold relevant information.

How does Vestige figure into Document Authentication?

Vestige routinely conducts digital document authentication in a wide range of cases. For example, being involved in a wrongful termination case, Vestige was able to determine that a critical disciplinary document was altered after the termination date, helping our client validate their claim. For a particular will contest matter, Vestige was able to prove that metadata of original digital voice recordings had been altered and the recordings clipped to exclude evidence that had it remained in the recordings it would have been helpful to the opposing side. We were not only able to provide the evidence for this activity, but were able to recover the clipped data as well, exposing the committed fraud. In another matter, Vestige was involved in a matter involving patent infringement. Engaged to authenticate CAD diagrams, we were able to determine that the designs of our client preceded the date of invention by the Plaintiff, invalidating the patent claim [Editorial note: this matter was adjudicated prior to the America Invents Act]

Conclusion

Our experience has shown that until verified, all evidence – especially Digital Evidence should be viewed with a healthy dose of skepticism. Today there are so many ways in which evidence can be altered, that digital document authentication can be a pivotal piece to any case. Many media formats can be altered by an individual in an attempt to mislead counsel. The good news is that a Digital Forensics Expert can combine his or her skills together with proper tools and experience to provide proper information to reveal the authentication of the evidence.

By Ian Finch, GCFA, Forensic Analyst at Vestige Digital Investigations

For more information CONTACT US.