Advanced Analysis Techniques
## ADVANCED DOCUMENT ANALYSIS
### Handwriting Analysis Basics
IMPORTANT DISCLAIMER:
Forensic handwriting analysis requires expert training and certification.
As citizen investigators, we can make basic observations but should never
make definitive determinations about authorship. Our role is to note
observations and recommend expert analysis when warranted.
WHAT WE CAN OBSERVE:
CONSISTENCY INDICATORS:
- Overall writing style (print vs. cursive)
- Letter formation patterns
- Spacing between words and letters
- Slant direction and consistency
- Pressure patterns (heavy vs. light)
- Size consistency
COMPARATIVE OBSERVATIONS:
When comparing known writing to questioned document:
- Similar letter formations
- Consistent slant patterns
- Comparable spacing
- Similar baseline alignment
- Pressure similarities
- Overall style match
RED FLAGS SUGGESTING DIFFERENT AUTHOR:
- Dramatically different letter formations
- Opposite slant direction
- Inconsistent spacing patterns
- Different baseline characteristics
- Unnatural letter connections
- Signs of tracing or simulation
WHAT TO DOCUMENT:
DESCRIPTION OF WRITING:
- Print, cursive, or mixed
- Slant (left, right, vertical)
- Size (small, medium, large)
- Pressure (light, medium, heavy)
- Spacing (tight, normal, wide)
- Baseline (straight, rising, falling)
- Distinctive letter formations
COMPARISON NOTES:
- Similarities observed
- Differences noted
- Overall impression (similar/different/uncertain)
- Confidence level (low/medium - never high)
- Recommendation for expert analysis
WHEN TO RECOMMEND EXPERT ANALYSIS:
- Document's authenticity is crucial to case
- Signature verification needed
- Anonymous letter authorship question
- Forged document suspected
- Legal proceedings may be involved
---
### Document Authentication
PURPOSE: Determine if document is genuine or forged/altered
VISUAL INSPECTION:
PAPER AND INK:
- Paper type and quality
- Age indicators (yellowing, brittleness)
- Watermarks present
- Ink type and color
- Ink consistency throughout
- Bleeding or feathering patterns
PRINTING/WRITING:
- Printing method (typewriter, laser, inkjet)
- Font consistency
- Alignment issues
- Print quality variations
- Handwriting consistency
PHYSICAL CONDITION:
- Fold marks and creases
- Stains or discoloration
- Tears or repairs
- Edge condition
- Overall wear pattern
RED FLAGS FOR FORGERY/ALTERATION:
INCONSISTENCIES:
- Mixed font types in typed document
- Ink color variations within document
- Different paper stock on same "page"
- Misaligned elements
- White-out or correction fluid
- Erasure marks
- Overwriting visible
ANACHRONISMS:
- Document dated before technology existed
Example: "laser printed" document from 1975
- Modern paper for old document
- Incorrect date formats for era
- Wrong typewriter font for claimed date
- Modern terminology in old document
SIGNS OF ALTERATION:
- Added text in different ink
- Whited-out sections
- Cut-and-paste indicators
- Photocopied signatures
- Numbers that don't align
- Date modifications visible
DIGITAL DOCUMENTS:
METADATA EXAMINATION:
- Creation date vs. claimed date
- Author information
- Modification history
- Software used
- Version tracking
PDF ANALYSIS:
- Check if scanned or digitally created
- Look for layers (editing indicator)
- Examine compression artifacts
- Check for copy-paste indicators
- Review embedded fonts
---
### Temporal Analysis
PURPOSE: Establish when document was created and verify claimed dates
DATING METHODS:
EXPLICIT DATES:
- Date written on document
- Postmark on envelope
- Timestamp on email/digital doc
- Date stamp on official documents
INTERNAL EVIDENCE:
- Events referenced with known dates
- Technology mentioned (dates product)
- Pop culture references
- Prices mentioned
- Phone number formats
- Address formats
PAPER AND INK DATING:
- Paper manufacturing date (watermarks)
- Ink formulation (chemical analysis - expert needed)
- Printing technology used
- Document degradation pattern
CONTEXTUAL DATING:
- Referenced people's ages/positions
- Business addresses mentioned
- Laws or policies referenced
- Social/political climate described
VERIFICATION PROCESS:
1. CHECK EXPLICIT DATE:
- Is date present and legible?
- Does format match era and location?
- Is it consistent throughout document?
2. VERIFY AGAINST KNOWN EVENTS:
- Events mentioned actually occurred?
- Dates of those events correct?
- Sequence of events logical?
- Timeline makes sense?
3. CHECK TECHNOLOGY:
- Technology available at claimed date?
- Format appropriate for era?
- Terminology correct for time period?
4. CROSS-REFERENCE:
- Compare to other documents from same period
- Check against known timeline
- Verify with independent sources
- Look for contradictions
---
### Language and Tone Analysis
PURPOSE: Understand author's state of mind, intentions, and credibility
EMOTIONAL INDICATORS:
STRESS/FEAR MARKERS:
- Urgent language ("must," "immediately")
- Repetition of concerns
- Catastrophic thinking
- Paranoid references
- Excessive punctuation (!!!)
- All caps usage
- Disjointed thoughts
ANGER INDICATORS:
- Harsh language
- Accusations and blame
- Threats or ultimatums
- Sarcasm or contempt
- Aggressive punctuation
- Profanity or insults
DECEPTION INDICATORS:
Note: These are only potential indicators, not proof
- Excessive detail in some areas, vague in others
- Passive voice ("mistakes were made")
- Distancing language ("that person" instead of name)
- Qualification hedges ("as far as I know")
- Unnecessary convincing ("honestly," "to tell the truth")
- Timeline inconsistencies in narrative
- Changed story between documents
AUTHENTICITY MARKERS:
- Consistent voice throughout
- Natural language flow
- Appropriate detail level
- Emotional consistency
- Personal touches
- Knowledge only author would have
---
### Comparative Document Analysis
PURPOSE: Analyze multiple documents together to find patterns and contradictions
COMPARING WITNESS STATEMENTS:
SETUP COMPARISON CHART:
Event/Detail | Witness A Says | Witness B Says | Witness C Says | Assessment
-------------|----------------|----------------|----------------|------------
Time arrived | 2:00 PM | 2:30 PM | 2:15 PM | Approximate agreement
Who present | John, Mary | John, Sarah | Mary, Sarah | Contradiction
What happened | Argument | Loud discussion | Normal talk | Interpretation varies
ANALYSIS QUESTIONS:
AGREEMENTS:
- Where do accounts match exactly?
- Where do they generally agree?
- What facts are corroborated?
- Which witnesses are consistent?
CONTRADICTIONS:
- Where do accounts directly conflict?
- Which contradictions are significant?
- Can contradictions be explained?
- Are some witnesses more reliable?
PATTERNS:
- Do certain witnesses always agree?
- Are contradictions random or systematic?
- Does one account seem coached?
- Are there impossibilities in any account?
---
### Document Series Analysis
PURPOSE: Analyze multiple related documents as a collection
CHRONOLOGICAL SERIES:
Examples:
- Series of letters between same people
- Monthly bank statements
- Police reports over time
- Medical records chronologically
WHAT TO TRACK:
EVOLUTION:
- How situation changes over time
- Relationship developments
- Financial trajectory
- Health progression
- Story consistency or changes
PATTERNS:
- Regular occurrences
- Cyclical behaviors
- Escalation indicators
- Warning signs
- Behavioral changes
GAPS:
- Missing documents in sequence
- Unexplained time periods
- Sudden changes without explanation
- Documents that should exist but don't
---
## SPECIALIZED DOCUMENT TYPES
### Death Certificates
STANDARD INFORMATION:
IDENTIFICATION:
- Full legal name
- Date of birth
- Age at death
- Social Security Number
- Residence address
DEATH DETAILS:
- Date of death
- Time of death
- Place of death (hospital, home, etc.)
- County of death
CAUSE OF DEATH:
- Immediate cause
- Intermediate cause
- Underlying cause
- Other significant conditions
- Manner of death
CERTIFYING INFORMATION:
- Medical examiner or physician name
- Date signed
- License number
WHAT TO VERIFY:
FACTUAL ACCURACY:
- Does date match other evidence?
- Is location consistent with known facts?
- Are personal details correct?
- Does timeline make sense?
CAUSE OF DEATH ANALYSIS:
- Does stated cause match circumstances?
- Are there inconsistencies?
- Is manner of death appropriate?
- Are contributing factors listed?
RED FLAGS:
- Delayed filing (why?)
- Amended certificate (what changed?)
- Vague cause of death
- Manner "undetermined" when seems clear
- Missing information
- Conflicts with other records
---
### Property Records and Deeds
WHAT THEY SHOW:
- Property ownership history
- Transfer dates and amounts
- Legal descriptions
- Liens and encumbrances
- Tax information
- Survey information
INVESTIGATIVE VALUE:
TIMELINE CONSTRUCTION:
- When person acquired property
- When sold or transferred
- Duration of ownership
- Simultaneous ownerships
FINANCIAL INFORMATION:
- Purchase prices
- Sale prices
- Mortgages and amounts
- Tax assessments
- Financial stress indicators
RELATIONSHIP MAPPING:
- Who sold to whom
- Family transfers
- Business relationships
- Hidden connections
LOCATION ANALYSIS:
- Where person lived when
- Property investments
- Geographic patterns
- Proximity to events
---
### Phone Records
TYPES OF PHONE RECORDS:
CALL DETAIL RECORDS (CDR):
- Calling number
- Called number
- Date and time
- Duration
- Cell tower location (sometimes)
- Type of call (voice, SMS)
TEXT MESSAGE RECORDS:
- Sender number
- Recipient number
- Date and time
- Length of message
- Message content (if available)
DATA USAGE RECORDS:
- Date and time of data use
- Amount of data
- Type of activity
- Location information
WHAT TO ANALYZE:
TIMELINE CORRELATION:
- Calls around key events
- Last known contact
- Pattern changes
- Unusual timing
CONTACT PATTERNS:
- Frequent contacts
- New contacts appearing
- Contacts disappearing
- Call frequency changes
LOCATION INDICATORS:
- Cell tower data
- Roaming indicators
- Geographic patterns
- Travel timeline
BEHAVIORAL PATTERNS:
- Normal call times
- Deviations from normal
- Stress indicators (increased calls)
- Relationship indicators (call frequency/duration)
---
### Social Media Records
WHAT TO PRESERVE:
POSTS AND CONTENT:
- Date and time of post
- Full text content
- Images or video links
- Comments and reactions
- Edit history (if visible)
- Privacy settings at time
METADATA:
- Location tags
- Tagged people
- Hashtags used
- Device posted from
- IP address (if available)
ACTIVITY LOGS:
- Friend/follow additions
- Account changes
- Profile updates
- Group memberships
- Check-ins
HOW TO DOCUMENT:
SCREENSHOTS:
- Full screenshot with date/time visible
- URL visible
- User profile visible
- Privacy settings shown
- Multiple shots if needed for full content
ARCHIVING:
- Save HTML source
- Download images/videos separately
- Print to PDF
- Note date of preservation
- Document method of access
IMPORTANT:
- Social media can be deleted
- Posts can be edited
- Privacy settings can change
- Accounts can be deactivated
- Preserve immediately when found
---
### Email Analysis
HEADER INFORMATION:
CRITICAL FIELDS:
- From: sender address
- To: recipient address
- Date: when sent
- Subject: topic
- Message-ID: unique identifier
TECHNICAL FIELDS:
- Received: server route
- Return-Path: sender server
- X-Originating-IP: sender IP address
- DKIM/SPF: authentication info
WHAT HEADERS REVEAL:
SENDER VERIFICATION:
- Is "From" address genuine?
- Does server route match claimed sender?
- Are authentication checks passing?
- IP address location
TIMING:
- Exact send time
- Time zones
- Delay in delivery (if any)
- Time of each server hop
AUTHENTICATION:
- SPF record check
- DKIM signature verification
- DMARC policy
- Likelihood of spoofing
RED FLAGS:
- Mismatched sender information
- Failed authentication
- IP address doesn't match claimed location
- Unusual server route
- Headers missing or incomplete
## ADVANCED DOCUMENT ANALYSIS
### Handwriting Analysis Basics
IMPORTANT DISCLAIMER:
Forensic handwriting analysis requires expert training and certification.
As citizen investigators, we can make basic observations but should never
make definitive determinations about authorship. Our role is to note
observations and recommend expert analysis when warranted.
WHAT WE CAN OBSERVE:
CONSISTENCY INDICATORS:
- Overall writing style (print vs. cursive)
- Letter formation patterns
- Spacing between words and letters
- Slant direction and consistency
- Pressure patterns (heavy vs. light)
- Size consistency
COMPARATIVE OBSERVATIONS:
When comparing known writing to questioned document:
- Similar letter formations
- Consistent slant patterns
- Comparable spacing
- Similar baseline alignment
- Pressure similarities
- Overall style match
RED FLAGS SUGGESTING DIFFERENT AUTHOR:
- Dramatically different letter formations
- Opposite slant direction
- Inconsistent spacing patterns
- Different baseline characteristics
- Unnatural letter connections
- Signs of tracing or simulation
WHAT TO DOCUMENT:
DESCRIPTION OF WRITING:
- Print, cursive, or mixed
- Slant (left, right, vertical)
- Size (small, medium, large)
- Pressure (light, medium, heavy)
- Spacing (tight, normal, wide)
- Baseline (straight, rising, falling)
- Distinctive letter formations
COMPARISON NOTES:
- Similarities observed
- Differences noted
- Overall impression (similar/different/uncertain)
- Confidence level (low/medium - never high)
- Recommendation for expert analysis
WHEN TO RECOMMEND EXPERT ANALYSIS:
- Document's authenticity is crucial to case
- Signature verification needed
- Anonymous letter authorship question
- Forged document suspected
- Legal proceedings may be involved
---
### Document Authentication
PURPOSE: Determine if document is genuine or forged/altered
VISUAL INSPECTION:
PAPER AND INK:
- Paper type and quality
- Age indicators (yellowing, brittleness)
- Watermarks present
- Ink type and color
- Ink consistency throughout
- Bleeding or feathering patterns
PRINTING/WRITING:
- Printing method (typewriter, laser, inkjet)
- Font consistency
- Alignment issues
- Print quality variations
- Handwriting consistency
PHYSICAL CONDITION:
- Fold marks and creases
- Stains or discoloration
- Tears or repairs
- Edge condition
- Overall wear pattern
RED FLAGS FOR FORGERY/ALTERATION:
INCONSISTENCIES:
- Mixed font types in typed document
- Ink color variations within document
- Different paper stock on same "page"
- Misaligned elements
- White-out or correction fluid
- Erasure marks
- Overwriting visible
ANACHRONISMS:
- Document dated before technology existed
Example: "laser printed" document from 1975
- Modern paper for old document
- Incorrect date formats for era
- Wrong typewriter font for claimed date
- Modern terminology in old document
SIGNS OF ALTERATION:
- Added text in different ink
- Whited-out sections
- Cut-and-paste indicators
- Photocopied signatures
- Numbers that don't align
- Date modifications visible
DIGITAL DOCUMENTS:
METADATA EXAMINATION:
- Creation date vs. claimed date
- Author information
- Modification history
- Software used
- Version tracking
PDF ANALYSIS:
- Check if scanned or digitally created
- Look for layers (editing indicator)
- Examine compression artifacts
- Check for copy-paste indicators
- Review embedded fonts
---
### Temporal Analysis
PURPOSE: Establish when document was created and verify claimed dates
DATING METHODS:
EXPLICIT DATES:
- Date written on document
- Postmark on envelope
- Timestamp on email/digital doc
- Date stamp on official documents
INTERNAL EVIDENCE:
- Events referenced with known dates
- Technology mentioned (dates product)
- Pop culture references
- Prices mentioned
- Phone number formats
- Address formats
PAPER AND INK DATING:
- Paper manufacturing date (watermarks)
- Ink formulation (chemical analysis - expert needed)
- Printing technology used
- Document degradation pattern
CONTEXTUAL DATING:
- Referenced people's ages/positions
- Business addresses mentioned
- Laws or policies referenced
- Social/political climate described
VERIFICATION PROCESS:
1. CHECK EXPLICIT DATE:
- Is date present and legible?
- Does format match era and location?
- Is it consistent throughout document?
2. VERIFY AGAINST KNOWN EVENTS:
- Events mentioned actually occurred?
- Dates of those events correct?
- Sequence of events logical?
- Timeline makes sense?
3. CHECK TECHNOLOGY:
- Technology available at claimed date?
- Format appropriate for era?
- Terminology correct for time period?
4. CROSS-REFERENCE:
- Compare to other documents from same period
- Check against known timeline
- Verify with independent sources
- Look for contradictions
---
### Language and Tone Analysis
PURPOSE: Understand author's state of mind, intentions, and credibility
EMOTIONAL INDICATORS:
STRESS/FEAR MARKERS:
- Urgent language ("must," "immediately")
- Repetition of concerns
- Catastrophic thinking
- Paranoid references
- Excessive punctuation (!!!)
- All caps usage
- Disjointed thoughts
ANGER INDICATORS:
- Harsh language
- Accusations and blame
- Threats or ultimatums
- Sarcasm or contempt
- Aggressive punctuation
- Profanity or insults
DECEPTION INDICATORS:
Note: These are only potential indicators, not proof
- Excessive detail in some areas, vague in others
- Passive voice ("mistakes were made")
- Distancing language ("that person" instead of name)
- Qualification hedges ("as far as I know")
- Unnecessary convincing ("honestly," "to tell the truth")
- Timeline inconsistencies in narrative
- Changed story between documents
AUTHENTICITY MARKERS:
- Consistent voice throughout
- Natural language flow
- Appropriate detail level
- Emotional consistency
- Personal touches
- Knowledge only author would have
---
### Comparative Document Analysis
PURPOSE: Analyze multiple documents together to find patterns and contradictions
COMPARING WITNESS STATEMENTS:
SETUP COMPARISON CHART:
Event/Detail | Witness A Says | Witness B Says | Witness C Says | Assessment
-------------|----------------|----------------|----------------|------------
Time arrived | 2:00 PM | 2:30 PM | 2:15 PM | Approximate agreement
Who present | John, Mary | John, Sarah | Mary, Sarah | Contradiction
What happened | Argument | Loud discussion | Normal talk | Interpretation varies
ANALYSIS QUESTIONS:
AGREEMENTS:
- Where do accounts match exactly?
- Where do they generally agree?
- What facts are corroborated?
- Which witnesses are consistent?
CONTRADICTIONS:
- Where do accounts directly conflict?
- Which contradictions are significant?
- Can contradictions be explained?
- Are some witnesses more reliable?
PATTERNS:
- Do certain witnesses always agree?
- Are contradictions random or systematic?
- Does one account seem coached?
- Are there impossibilities in any account?
---
### Document Series Analysis
PURPOSE: Analyze multiple related documents as a collection
CHRONOLOGICAL SERIES:
Examples:
- Series of letters between same people
- Monthly bank statements
- Police reports over time
- Medical records chronologically
WHAT TO TRACK:
EVOLUTION:
- How situation changes over time
- Relationship developments
- Financial trajectory
- Health progression
- Story consistency or changes
PATTERNS:
- Regular occurrences
- Cyclical behaviors
- Escalation indicators
- Warning signs
- Behavioral changes
GAPS:
- Missing documents in sequence
- Unexplained time periods
- Sudden changes without explanation
- Documents that should exist but don't
---
## SPECIALIZED DOCUMENT TYPES
### Death Certificates
STANDARD INFORMATION:
IDENTIFICATION:
- Full legal name
- Date of birth
- Age at death
- Social Security Number
- Residence address
DEATH DETAILS:
- Date of death
- Time of death
- Place of death (hospital, home, etc.)
- County of death
CAUSE OF DEATH:
- Immediate cause
- Intermediate cause
- Underlying cause
- Other significant conditions
- Manner of death
CERTIFYING INFORMATION:
- Medical examiner or physician name
- Date signed
- License number
WHAT TO VERIFY:
FACTUAL ACCURACY:
- Does date match other evidence?
- Is location consistent with known facts?
- Are personal details correct?
- Does timeline make sense?
CAUSE OF DEATH ANALYSIS:
- Does stated cause match circumstances?
- Are there inconsistencies?
- Is manner of death appropriate?
- Are contributing factors listed?
RED FLAGS:
- Delayed filing (why?)
- Amended certificate (what changed?)
- Vague cause of death
- Manner "undetermined" when seems clear
- Missing information
- Conflicts with other records
---
### Property Records and Deeds
WHAT THEY SHOW:
- Property ownership history
- Transfer dates and amounts
- Legal descriptions
- Liens and encumbrances
- Tax information
- Survey information
INVESTIGATIVE VALUE:
TIMELINE CONSTRUCTION:
- When person acquired property
- When sold or transferred
- Duration of ownership
- Simultaneous ownerships
FINANCIAL INFORMATION:
- Purchase prices
- Sale prices
- Mortgages and amounts
- Tax assessments
- Financial stress indicators
RELATIONSHIP MAPPING:
- Who sold to whom
- Family transfers
- Business relationships
- Hidden connections
LOCATION ANALYSIS:
- Where person lived when
- Property investments
- Geographic patterns
- Proximity to events
---
### Phone Records
TYPES OF PHONE RECORDS:
CALL DETAIL RECORDS (CDR):
- Calling number
- Called number
- Date and time
- Duration
- Cell tower location (sometimes)
- Type of call (voice, SMS)
TEXT MESSAGE RECORDS:
- Sender number
- Recipient number
- Date and time
- Length of message
- Message content (if available)
DATA USAGE RECORDS:
- Date and time of data use
- Amount of data
- Type of activity
- Location information
WHAT TO ANALYZE:
TIMELINE CORRELATION:
- Calls around key events
- Last known contact
- Pattern changes
- Unusual timing
CONTACT PATTERNS:
- Frequent contacts
- New contacts appearing
- Contacts disappearing
- Call frequency changes
LOCATION INDICATORS:
- Cell tower data
- Roaming indicators
- Geographic patterns
- Travel timeline
BEHAVIORAL PATTERNS:
- Normal call times
- Deviations from normal
- Stress indicators (increased calls)
- Relationship indicators (call frequency/duration)
---
### Social Media Records
WHAT TO PRESERVE:
POSTS AND CONTENT:
- Date and time of post
- Full text content
- Images or video links
- Comments and reactions
- Edit history (if visible)
- Privacy settings at time
METADATA:
- Location tags
- Tagged people
- Hashtags used
- Device posted from
- IP address (if available)
ACTIVITY LOGS:
- Friend/follow additions
- Account changes
- Profile updates
- Group memberships
- Check-ins
HOW TO DOCUMENT:
SCREENSHOTS:
- Full screenshot with date/time visible
- URL visible
- User profile visible
- Privacy settings shown
- Multiple shots if needed for full content
ARCHIVING:
- Save HTML source
- Download images/videos separately
- Print to PDF
- Note date of preservation
- Document method of access
IMPORTANT:
- Social media can be deleted
- Posts can be edited
- Privacy settings can change
- Accounts can be deactivated
- Preserve immediately when found
---
### Email Analysis
HEADER INFORMATION:
CRITICAL FIELDS:
- From: sender address
- To: recipient address
- Date: when sent
- Subject: topic
- Message-ID: unique identifier
TECHNICAL FIELDS:
- Received: server route
- Return-Path: sender server
- X-Originating-IP: sender IP address
- DKIM/SPF: authentication info
WHAT HEADERS REVEAL:
SENDER VERIFICATION:
- Is "From" address genuine?
- Does server route match claimed sender?
- Are authentication checks passing?
- IP address location
TIMING:
- Exact send time
- Time zones
- Delay in delivery (if any)
- Time of each server hop
AUTHENTICATION:
- SPF record check
- DKIM signature verification
- DMARC policy
- Likelihood of spoofing
RED FLAGS:
- Mismatched sender information
- Failed authentication
- IP address doesn't match claimed location
- Unusual server route
- Headers missing or incomplete
