All copy and transmission rights reserved by the IICFIP USA, Incorporation

MODULE NO. 3
This module covers Preparation of Suspects/ witnesses
rough list and Document Examination- an introduction.

Preparation of witnesses and suspects rough list

Introduction

This is step 4 of the forensic investigation process. It is at this stage that a proper investigation

commences. At this stage, the Certified Forensic Investigation Professional (CFIP) comes up

with a list of suspects and witnesses. According to the International Institute of Certified

Forensic Investigation Professionals Inc. (IICFIP Inc), forensic investigators should prepare this

list at the preliminary review stage or rather gather information for the preparation of this list(s)

during Step 1: the Preliminary Review Step.

If these lists are not prepared at the preliminary state, then the information gathered in the

preliminary step will be of great help here. It is the same list that will be used in the interview

steps. What I am saying here is that, its the client that will provide the initial list of suspects and

witnesses during your interviews with him or her during the preliminary review step. Therefore,

it has to be updated with as more information as possible. Since it is the client that gives out a

list, the list should give room to accommodate addition of other potential possible suspects or

witnesses. I will start by defining a witness and a suspect.

A witness is a person, excluding a defendant, likely to avail evidence in a court of law.

Nonetheless, all victims may be considered witnesses and must be treated as such. Whereas a

suspect is a person who is most likely to be guilty of an offense. To succeed in any investigation,

the investigator has to get accurate details from witnesses. Forensic Investigators, whether tasked

1
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

with a volume crime or major investigation, must recognize the individual needs and concerns of

witnesses and treat them with dignity and respect. This can have a significant impact on how

witnesses cooperate with the investigation and any subsequent prosecution.

A Rough List is basically the list of possible suspects, and witnesses that can aid in the success

of the investigation.

To prepare a list of potential suspects or witnesses;

Examine all available evidence - witness statements, scene examination, exhibits and

other supporting documents.

Use information given by the client during the preliminary step.

Identifying and locating witnesses

Some witnesses may self-present or be self-evident, whereas other witnesses may be more

difficult to identify and/or locate. Investigating officers must therefore develop clear intelligence-

led objectives for identifying witnesses. These will depend on the circumstances of the case but

should include identifying settings and communities where witnesses are likely to be found.

Communities may be cultural, religious, sporting, occupational, clubs, associations or societies.

Resources can then be directed towards identifying witnesses.

Methods for identifying and locating witnesses:

viewing through CCTVs.

media appeals.

house-to-house enquiries.

interviews with victims and other witnesses.

suspect interviews.

2
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

financial investigation.

open-source internet search tools.

social media.

To preserve witness testimony, the witnesses should not be allowed to discuss anything with

suspects and vice versa. It must be noted here that the lists of witnesses/suspects are not fine until

the interviews are concluded. These lists will keep on changing until interviews on chapter 6 and

7 are concluded. Experience has shown that the witnesses lists proposed by the clients. Later on

turn to be suspects and suspects proposed by the client turn out to be witnesses. Why do you

think this happen? Clients being human as they are, are sometimes biased as opposed to their

investigators.

Experience has also shown that the staff that are most trusted by the client are the most

dishonesty, and in fact most clients get shocked to learn that the trusted staff are the principal

suspects for financial wrong doing in their organizations.

Take relevant extracts from witness statements/ reports to assist in your written plan. From

experience, it has proved rather challenging work where the investigator starts work with any list

of suspects and witnesses. In this case, the investigators mandate is to find out who was

responsible for the perpetration of the wrong doing and also find out the co-perpetrators.

The list arrived at before is not exhaustive and that is why it is called a rough list. It will be

discovered in chapter 6 and 7 that as an actual interview of witnesses and suspects progress on,

some of the witnesses will close ranks and become suspects and some of the suspects will also

become witnesses. The rough list usually provides a nice point where to start from and then

progress on.

3
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Characteristics of an Effective Interview

To be successful, an interview should be thorough. It requires strategic planning, relevant

questions and an objective interviewer. Many interviews fail to gather enough information to

address the issues raised in a forensic matter because of inadequate preparation, or because

insufficient time is allowed to complete the interview. If an interview is scheduled in advance, as

many are, there is a natural tendency to schedule a set time for its initiation and completion. If

possible, sufficient time should be allowed to conduct the interview with the time of completion

left open ended. If a set time is established, the person interviewed may be overly focused on the

ending time, thereby inhibiting a flow of information. Interviewers can enhance their credibility

by focusing on information that the interviewee should know, as opposed to guessing during the

interview and thereby wasting the time of the participants by asking questions that the

interviewee could not know. By remaining objective and fair, the interviewers can better gain the

confidence of the interviewee. Ideally, the interview should be conducted as soon as the alleged

impropriety has been discovered and very close to the crime scene. In fraud cases, this will be of

particular importance since the interviewee may wish to pull out a document from a file, for

instance. More discussion on interviewing is on chapters 6 and 7 of this book.

An effective interviewer should be an active listener, as well as an active observer. Both are

learned skills that can be studied and improved with practice. Active listening means not only

listening more than talking, but really hearing what is being said and how it is being

communicated. Sometimes what is not being said is equally as important as what has been said

by the interviewee.

4
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Documentary evidence gathering and

examination
Introduction

This discusses the step number 5 of the investigation process. This is the main body of an
investigation that involves analysis of transactional documents. Documentary evidence gathered
in a forensic audit case resembles that of normal audit but differs in details and intensity. A
forensic investigator is not allowed to rely on sampling whereas an auditor uses sampling as one
of his/her important audit techniques and in the process skips many crucial and critical
evidences. The mindset of the forensic investigator is that of finding evidence for or against an
allegation. The evidence so collected must be capable of providing proof beyond reasonable
doubt.

Documentary evidence collection must follow the best evidence rule, which states that if a
document is to be produced as evidence it must be in its original form. If not a certified copy
must be produced with reasons why original is not available. Documents that provide evidence
are forged invoices, receipts, purchase orders, cheques, contracts, agreements, authorization
letters, appointment letters, promotion letters, determination letters, falsified financial statements,
tax records, diaries, emails, suicide notes, bills delivery notes, dispatch notes, transfer notes
random notes and many more.

Approach
A Certified Forensic Investigation Professional must plan his/her documentation evidence
gathering well ensuring that he/she targets the crime scene and carry out a 100% testing and
evidence collection. Sampling is not encouraged in forensic investigations/auditing. This will
ensure a reasonable expectation of collecting all the documentary evidence available without
skipping any. All documents interrelations must be traced and all relevant documents collected
from within that investigative area or outside so long as the other documents point to it. This will
be discussed further under external confirmations.

5
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Investigative Fieldwork

Once the team is put together, the practitioner usually begins investigative fieldwork to set up the

validity of the claim. This mainly, involves examination of documents, and analytical

procedures, and evidence collection, and subject interviews. It is at this stage that a lot of time

has to be allocated.

Should it be substantiated, the conclusions / findings/ results of the investigation may possibly

conclude in a civil litigation. It is highly suggested that the practitioner conduct each

investigation with the intent of proving "beyond a reasonable doubt" as required by criminal

courts of law. In most cases, civil courts need enough proof by a preponderance of the evidence/

confirmation. Confirmations which satisfy the requirements of a criminal court will probably

meet the requirements of civil proceedings.

According to the former Internal Revenue Service Agent, Richard Nose, there are seven different

forensic techniques to consider when conducting an investigation of alleged financial related

crimes. Recently, NACVA included these techniques into its Forensic Accounting Academy

syllabus. These include the following:

1. Public Document Reviews & Background Investigations;

2. Interviews of Relevant Persons;

3. Confidential Sources;

4. Laboratory Analysis of Physical & Electronic Evidence;

5. Physical & Electronic Surveillance;

6. Undercover Operations; and

7. Analysis of Financial Transactions.

6
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

The addition of these steps will assist make sure a complete review of all facts and an effective

and efficient resolution of the investigation procedures.

Any method of obtaining evidence can be used in a forensic investigation engagement contracts.

This may not be limited assurance engagement in which procedures are likely to be restricted to

enquiry and analytical actions. These engagements include a detailed and wholesale review of all

documentation and electronic evidence accessible. The view given by the expert forensic

accountant must be reasoned, and backed up by evidence/ confirmation. Their view cannot be

objective if only based on what they are told; they must corroborate that statement.

To achieve success in your forensic investigation, the procedures used must not be vague. In fact,

they have to be very specific enough that the engagement team could actually follow your

instructions/ directions. For instance, it may not be sufficient to write 'interview the suspect'. The

investigator must come up with questions that should be asked of the suspect in interview/

interrogation, depending on the circumstances in the situation. For instance, he/ she may ask the

suspect to explain their job, role and what access that gives them to systems, inventory, and cash.

This also applies when recommending enquires of or discussions with management. In this case,

it ought to be concise in the answer especially what the engagement team should ask of them,

such as have they informed the law enforcers, has the suspect been suspended, and have they

informed the insurer? On the same note, it may not be sufficient to suggest the use of CAATs. In

that case, one must specify how the CAATs could be applied. For instance, information

matching bank accounts used for paying suppliers with bank accounts for paying workforce,

exception reports identifying employees who are not taking holiday.

To design appropriate procedures you must identify the type of forensic investigation

engagement contracts, and the particular type of crime, negligence claim as mentioned on the

7
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

introduction. Take for instance in quantifying the theft of goods will be very different from

quantifying a loss from payroll or ghost employee fraud or loss of profits following a business

disruption.

An abundance of crucial information can be gleaned from documents related to criminal

cases. For example, a suicide note found next to the departed, was it actually written by a
killer trying to cover up their crime? The wealthy individuals, was it altered so that a
relative could receive a hand-out?
The discipline of forensic document examination, often referred to as (questioned

documents) is regularly linked with white collar crimes like fraudulent checks;

nevertheless, in excises, this part of forensic science may be applied in a wide array of

cases from medical malpractice to art forgeries, and to homicide(s).

Armed with complicated know-how, examiners can peer into the visible and invisible

marks on a document to extract an abundance of details that may verify authenticity or

provide additional information crucial to the investigation process.

The digital age has made the work of forensic document examiners even more important.

With the availability of powerful software programs such as Photoshop, Adobe, amongst

others. In fact, it has ended up being significantly easier for criminals to create and

manipulate all manners of fraudulent documents from contracts to money.

Principles of Forensic Document Examination

Forensic document examiners often deal with questions of document genuineness. In order to

establish whether a document is authentic, the examiner may attempt to confirm who

created the document(s), establish the timeframe in which it was twisted, recognize the

materials used in its preparation or uncover modifications to the original text/ message.

Document(s) may be examined for evidence of obliterations, page substitutions, and alterations.

8
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Or rather the examiner can study the materials, machines, and methods that created the

document(s), availing the main information that can identify or narrow the possible

sources of the document. The paper, writing tools, ink, seals, ribbons, and stamps used in

production of a document may all reveal important clues/ leads. A document examiner

may even discover valuable evidence in a documents invisible impressions/ imitation.

A Main element of document examination focuses on Handwriting/ calligraphy. The

examination and comparison of a handwriting that includes signatures and the hand, is based on

3 main principles:

1. Given a sufficient amount of handwriting, no two skilled writers exhibit

identical handwriting features;

2. Every person has a range of natural variation to his or her writing; and

3. No writer can exceed his or her skill level.

Computer databases maintained by the United States Secret Service, the German Federal Police

and Federal Bureau of Investigation contain handwriting samples from hundreds of thousands of

writers. The Comparisons of these databases have not identified two individuals who have the

exact same combination of handwriting features adding up to the authenticity of handwriting as a

solid form of confirmation.

9
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Why and when is a forensic document examination used?

Since documents are part of daily life, document examiners work a vast variety of instances.

Document examiners are called to investigate the authenticity of documents in situations such as:

Forgeries Kidnappings

Counterfeiting Extortion

Identity theft Stalking

Fraud Contested wills

Suicides Contested contracts

Homicides Medical malpractice

Bank robberies Title/deed lawsuits

Table 1: Document examiners are called to investigate the authenticity of documents in situations above

Forensic document examiners are most frequently asked to resolve questions of authorship. This

question includes whether the signature on the mortgage loan is genuine or not. Can you say

who wrote this anonymous note?. Simply by doing this comparison of documents found at a

crime scene to a suspects known writing samples, the document examiner is able confirm who

wrote the note and include or exclude suspects from the examination. The document examiner

can also be a CFIP that has majored in such examinations, and undertaken special training in

documents examination

10
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Ransom Note Nabs Kidnapper

A 1956 kidnapping case from Long Island, New York, helps illustrate the key role forensic

document examination can play in an investigation. In this case, a one Month old child was taken

from his home and a ransom note was found in the babys carriage, supposedly left by the childs

babysitter.

Investigators discovered distinguishing characteristics in the way the writer formed 16 letters of

the alphabet, most notably the lowercase m, which resembled a sideways z. Investigators

searched through nearly two million documents looking for similar writing until a probation

officer found in his files documents written by a 31year old auto mechanic with the same

peculiar m. Document examiners were able to conclusively match the ransom note to the

suspects handwriting, helping to secure a conviction. It was discovered that it was the mechanic

who murdered the one month old child not the babysitter.

Fraudulent Checks

A common problem brought to forensic document examiners involves alterations, especially to

legal documents. For instance, if someone altered a check to increase its amount, examiners may

be able to determine this by comparing the way the inks from different pens react when subjected

to infrared radiation.

In the example below, a check made out to Cash for USD 1,000 has been altered by changing

the 1 to a 9 and adding a recipients name. Although the black inks appear the same in

visible light, when subjected to certain frequencies of infrared light, the ink used to prepare the

11
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

genuine check reacts differently than the ink used to alter the check, making the alteration

obvious.

Figure 1: Fraudulent Checks

Figure 2: Fraudulent Checks 2

Documents in a suspects possession may also reveal clues from hidden impression

evidence that could link a suspect to a crime. For instance, did the bank robbery

suspect write the hold-up note on top of another piece of paper that now contains

impression of that?

12
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Figure 3: Note from The suspect

Examiners can also identify the materials, inks and even the type of office equipment or writing

implements used to produce the document. This is especially useful in fraud cases because these

details can identify the time frame in which a document was created. For instance, if an analysis

of the documents paper reveals a substance that was not used in paper manufacturing during the

time frame in question, the document, piece of art, or historical record would be demonstrated to

be fraudulent.

How is it done?

Evidence That May Be Examined

Questioned material may consist of identification cards, contracts, wills, titles and deeds, seals,

stamps, bank checks, handwritten correspondence, machine Generated documents (such as those

13
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

from photocopiers, fax machines, and printers), currency and electronic documents. In some

circumstances, graffiti and digital signatures may be examined; however, the client should be

aware that the examination of these types of evidence can be problematic.

Documents that does not contain visible identifiable marks may contain valuable impression

evidence if they were underneath other documents when the writing was performed. Even

documents that were shredded or burned may prove useful if reconstructed.

In addition, writing instruments, rubber stamps, envelopes and makes/models of office

equipment in the suspects possession may be collected by the investigator. In digital documents,

evidence could even be collected from the metadata of electronic signature files, providing

information such as who the author is and when the document was written.

Collecting the Known and Unknown

When conducting examinations, forensic document examiners must have known specimens to

which they compare the material in question. These samples may come from any number of

known sources, such as a particular ink manufacturer or machine. In cases involving

handwriting, samples are usually divided into two types:

A. Requested writing specimens.

B. Collected writing specimens.

Requested specimens are writings dictated by the investigator to the writer. These specimens

are created under carefully controlled conditions, with the writer being closely monitored.

Collected writing specimens, however, are writings that were completed by the suspect prior to

the investigation. Good sources of writing specimens may include items such as cancelled

14
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

cheques, letters, diaries, signed receipts, medical records, real estate contracts, tax records or

other signed legal documents.

Who is to conduct the Analysis?

Analysis ought to be done by a qualified forensic document inspector, if possible one who is a

member of a well established professional association like the ABFDE or the ASQDE or other

professional however permitted document examiner in ones state.

Membership requirements for these associations differ; nevertheless, an examiner typically must

have completed a two year, full time training program under the guidance of a qualified forensic

document investigator. In order to maintain membership in good standing and keep their skills

present, inspectors/ examiners are required to complete continuing training and personal

development. If the examiners are members of the IICFIP USA Inc they must also conform to

the 48 CPD requirements of the institute in general investigative training.

How and Where the Analysis Is Performed

Forensic document examiners either work as private examiners within their own laboratory, or

for publicly funded laboratories. If an agency does not have questioned documents analysis

capabilities, investigators may opt to send the evidence to a nearby lab, or retain a private

examiner.

The techniques and tools used in forensic document examinations leverage well established

principles of physics and chemistry. A typical Questioned Documents Unit in a crime laboratory

is equipped with microscopes, digital imaging instrumentation, infrared and ultraviolet light

sources, video analysis tools and specialized equipment including electrostatic detection devices

(EDD) and materials to perform analytical chemistry.

15
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Many forensic document examiners use only non Destructive techniques that use light and/or

electrostatics to examine documents for indented impression evidence or ink differentiation.

However, a few examination techniques, such as liquid chromatography, are considered

destructive because they require removal of small samples of ink from the questioned

documents. These types of examinations may be sent off to laboratories that specialize in this

type of ink analysis.

For analyses of documents created by typewriters, fax machines, or printers, examiners may rely

on various databases created for comparison purposes. During handwriting analyses, examiners

compare samples provided from particular populations. Certain agencies, such as the U.S. Secret

Service and the German Federal Police, maintain larger databases. For example, the Forensic

Information System for Handwriting (FISH) maintained by the U.S. Secret Service Forensic

Laboratory contains handwriting samples from tens of thousands of writers.

Revealing text from indented impressions Documents that may contain indented impressions

not visible to the naked eye can be visualized through the use of an Electrostatic Detection

Device (EDD) such as the Electrostatic Detection Apparatus (ESDA). An EDD uses applied

charges and toner to visualize areas of indented writing, making them visible to the eye. The

ESDA uses the principle that indented areas of the document carry less negative charge than

surrounding areas. This causes the toner used in the EDD to be attracted to these areas, revealing

indentations that are present.

Using this technique, indented impressions have been recovered from up to seven layers of paper

beneath the original writings. Research has demonstrated that impressions can be successfully

visualized from documents up to 60 years old, provided the papers are not mishandled or stored

improperly.

16
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Detecting alterations obliterations erasures and page substitutions Alterations, obliterations

and erasures not visible to the human eye can often be detected through use of photography and

other imaging devices that utilize ultraviolet and infrared wavelengths of light. Using radiation

filtered at various wavelengths, an imaging instrument such as a video spectral comparator

(VSC) can reveal writing that has been added with a different ink, or has been altered or removed

by exploiting variations in the way different inks respond to different wavelengths of light. For

example, under certain light sources combined with an infrared filter, a document containing

information written in ink that has faded over time may be enhanced or processed to appear

darker and therefore more legible.

Figure 4: Obliterated Note View with Visible Light (Courtesy of Marie Durina)

17
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Figure 5: Same Note Viewed With Infrared Radiation (Courtesy of Marie Durina)

Determining individual dye components an examination called liquid chromatography can be

conducted to identify the chemical composition of inks on a document. In this technique, a small

cutting from the questioned document is dissolved in a solvent and analyzed. This is one of the

few destructive techniques employed by the document examiner. The inks can be compared to

the International Ink Library, a database maintained by the U.S. Secret Service that contains data

on more than 9,500 inks that have been manufactured since 1920.

Typewritten and machine printed documents Documents created on a typewriter or printed

with ink jet, laser printers, fax machines and photocopiers may be sourced to a particular make

or model, or even to a specific machine. The printing process used to prepare documents can

also be identified. When possible, the examiner should obtain known standards and any available

accessories from the machine in question and the machine itself should be submitted for

examination.

Seals and stamps Questioned documents bearing rubber stamp impressions, embossed seals,

watermarks, or other mechanically printed marks may be submitted for examination. When

possible, it is best to provide the examiner with any suspected devices associated with the

18
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

questioned document that may have been involved in its preparation. This includes writing

instrument(s), papers, or other substances, rubber stamp(s), sealing devices (such as notary

seals), printing devices or other mechanisms.

To illustrate the value of a manufacturers mark, consider a 1989 case when a young girl was

kidnapped and murdered. Investigators called in forensic document examiners to examine the

plastic garbage bag in which the victim was found. The minute markings created by the heat, and

sealing process used in manufacturing such bags enabled investigators to determine that the bag

was manufactured on the same machine within seconds of other bags found in the parents

house. This was key evidence that resulted in the conviction of the girls mother for murder.

Examination of handwriting When a sufficient amount of writing from two different people

is closely examined, there are always identifiable differences. Comparisons of writing samples

take into consideration a wide variety of handwriting characteristics including words and letter

spacing, slant or slope, speed, pen position, capitalization of letters, embellishments, legibility,

use of punctuation, proportion of letters and other attributes; for example, one person may form

the letter O in a clockwise motion, while another may form the same letter in a counter

clockwise motion. A particular writer may form the letter M using an upward moving arch

formation, while another prefers to make a garland form of M, forming this letter with a U

motion to resemble the garland on a Christmas tree. Document examiners take into account the

various combinations of features present within the writing sample as a whole. In addition,

examiners look for features such as hesitations in the natural flow of writing, possible retouching

or unnatural tremors. These may indicate that an unnatural writing process has been employed.

No one writes with a machine like precision every time, and variations are evident in a persons

handwriting even within the same document. For example, if a person writes an entire page of

19
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

signatures, each one will vary slightly. A trained forensic document examiner can discriminate

between natural variations in a writers own handwriting and significant differences denoting

different writers.

To conduct handwriting comparisons, the investigator should obtain known writing samples that

are similar in character to the document in question. If it is written in cursive, it should be

compared to known cursive writing. If it contains upper and lowercase letters, the known

writings must also contain upper and lowercase letters. Wherever possible, the investigator

should also obtain known writing containing similar combinations of letters and numbers seen in

the questioned documents. For comparison purposes, it is recommended that investigators obtain

2030 repetitions of signatures, 1520 repetitions of bank checks, 34 repetitions of entire

written letters. The investigator should also attempt to obtain known writing that is prepared

around the same time period as the questioned writing. This is particularly important in cases

involving writing from young people, as writing formation may still be at a developmental stage,

and by elderly persons, as writing may deteriorate with age or illness.

Documentary techniques

These are basically the techniques applied in categorizing, investigating, interpreting and

identifying the boundaries of physical sources, such as written documents, whether in the private

or public domain.

Criteria for Assessing the Quality of Evidence

The following are the generally accepted criteria for assessing the quality of evidence:

1. Authenticity: Is the genuine evidence, and of unquestionable origin?

2. Credibility: Is the evidence free from error and distortion?

20
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

3. Representativeness: Is the evidence typical of its kind, and if not, is the extent of its

untypicality known?

4. Meaning: Is the evidence clear and comprehensible ?

5. Relevance: Is the evidence relevant?

Despite the fact that most documents are stored in paper containing printed matter, handwriting,

typewritten material, or a combination, valuable data or messages maybe left on the mirrors,

walls, locker doors or blackboards.

As a document examiner, you should thoroughly examine the questioned documents to draw

deductions concerning the authenticity or spuriousness of the documents. This examination

involves comparing and identifying signatures, establishing alterations, erasures and

substitutions amongst others problems, which concerns documents and their content. In most

cases, this examination also includes the examination of content of the message to check for

grammar, spelling, and punctuation.

According to Erickson (2014) the rules of evidence necessitate that the production of the original

document, unless if a satisfactory clarification is given for failing to produce the original; like the

loss of the original document. In cases of loss or destruction of the original, photocopies are

often accepted by the courts despite the fact that they may have undetected alterations, rendering

them unreliable. To solve this problem, the reproduction of photocopies must be accurate and

must be done on the original documents, but it is always best to examine originals. Other

problems, like dating documents and sequence of writing, necessitate the original document to

establish conclusions concerning the document. In an event that the originals are not accessible,

then the court may accept a first generation photocopy.

21
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

A first generation photocopy is a photocopy made from the original document. Every time a

photocopy is reproduced, the copy becomes a later-generation photocopy. Later generation

photocopies are much unreliable therefore courts do not readily accept them.

Transporting documents

Basically, evidence is gathered, secured, and sealed before the examiner enters the case. In most

cases, it is the duty of the examiner to go on to preserving the documents whilst they are in his or

her custody. Ideally, evidence is collected, safeguarded and preserved before a document

examiner enters the case. It is the responsibility of the document examiner to continue to

preserve the document while in his or her care and to return them intact to the forensic

investigator.

Evidence must be protected whenever it is transferred to another party. Original documents must

be safeguarded during transit. Original documents should never be sent through ordinary mail.

Insist that original documents be sent by registered mail if the client uses postal mail. Federal

express is preferred by many for its speed and ability to track the whereabouts of its parcels at all

times. Courier service is an alternative that keeps the documents secure at all times. Instruct the

clients that documents must be signed for and handed to a responsible person in the office.

If documents are picked up from the client, be sure to take proper materials for transporting the

documents safely. Original documents should be protected in envelopes or folders. Envelopes

should be large enough for the documents to lie flat. Documents should never be folded. Clear

plastic folders can be used if they are the type of plastic that does not stick to the documents.

Mylar folders are the best. Manila envelopes may also be used. Be certain that any information

placed on the envelope is done before the documents are inserted into the envelope. Documents

can also be transported in file folders in an attach case. They should never be placed in a pocket

22
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

or pocketbooks. It is against this background that evidence requires a chain of custody to ensure

its physical integrity at all times. Each part that handles the evidence must sign the chain of

custody as shown in the appendix 1 at the end of this book. Keeping good chain of custody for

all physical evidence that is moved from one place to another or from one person to the other is

required to assure the court that the item in court is the one that was collected from the crime

scene, and that it is in the same condition as the time of collection i.e. that has not been

contaminated or replaced or tampered with in any way significant enough to affect its integrity as

an exhibit.

Advantages of using documentary evidence

One of the key advantages in conducting documentary research is that you can get access to

information that would be difficult to get in any other way, such as people or cases who might

not be willing to talk in a formal research interview or might be difficult to track down. By using

documents you eliminate the effect that you, as an individual, have on a person or situation when

you conduct research. The effect you have on a situation or subject may be partly due to the

knowledge that you are there as a researcher. People will also be affected by how you conduct

yourself and how they perceive you. Issues of sex, age, race and other characteristics are likely to

have an impact on what people tell you or do when they know they are research subjects.

Documents are often particularly useful for tracking change over time; that is, doing longitudinal

research. Longitudinal research may be done either prospectively or retrospectively. Documents

often make possible the collection of data over a longer period of time as well as larger samples

than might be collected from questionnaires or interviews. Some documents may contain

spontaneous data, such as feelings, and refer to actions that are recorded in a specific context, not

23
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

with a view to answering a particular research question. Confessional documents may give us an

insight into how people see things or how they want to present things. Either way, they provide a

very particular account of reality whatever the confessor's motivation behind their account.

Further advantages of using documents in research include the fact that such research is

relatively low cost, particularly when the documents are easily accessible and already located in

your workplace, or on the internet. Documents vary a great deal in quality, often related to the

perceived importance of recording certain information, but some types of document can be

extremely detailed and yield much more information than you could hope to gain from a

questionnaire or interview. Other advantages of documentary evidence include.

They are relatively cheap and easy to access.

Documents can be invaluable for providing important details of events.

Documents make things visible and are traceable.

Documents may include various forms of evidence of non-formal, informal, and formal

evidence.

Can be streamlined through use of templates or e-Portfolio software.

Information can be electronically shared and stored.

Minimizes paper-based evidence collection.

Documents dont change mind or become emotional during repeated interrogation and

examination.

Documents do not forget.

Documents do not require appointments for examinations or interrogations

24
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Documentary evidence is the best evidence since documents never lie. Most of the

documentary evidences are keenly inspected before being accepted as evidence thereby

reduces any chances of them being ingenuine.

Documents will assist in establishing intent, which is one of the most important

elements in forensic investigation.

Documents do not suffer from the effects of fatigue.

Documents assist in quantifying the amount of loss; by examining the documents,

you get to the extent to which the act or other elicit activity being investigated has

progressed.

Documents may reveal conspirators; through following a proper chain of custody,

you are able to know possible conspirators to the act.

Documentary evidence is readily acceptable as evidence of financial wrong doing or

any other crime for which they are presented as evidence.

Disadvantages of using documentary evidence

Nevertheless, documents are usually not designed with research in mind. The information

recorded may be idiosyncratic or incomplete. Documents get misfiled, left on people's desks for

long periods or simply just do not get fully completed at all. Even standard ways of collecting

data in a police station may change, so there may be information that is available for one period

of time and not another. All of this will create gaps in data as well as coding difficulties. The

motivation to collect certain types of data will vary over time, perhaps related to the decision by

25
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

a particular team to focus on a specific issue for a period of time or because of government

targets. Other disadvantages of documentary evidence include.

1. Access can be difficult for some types of documents.

2. May be judged on presentation rather than content.

3. May be difficult to confirm authenticity/validity.

4. Requires writing and presentation analysis skills.

5. Requires document examination experts.

6. May get contaminated if not carefully handled.

7. May be misplaced or destroyed if not kept well.

8. The writing on the document may fade irretrievably.

Documentary Evidence

Documentary evidence is a document presented and allowed as evidence in a hearing or trial, but

not oral testimony. Nevertheless, in some cases, the opposing attorney may decline for it to be

admitted. From the onset, it must be proved by other evidence from a witness that the paper is

genuine and authentic.

Gathering evidence

In order to gather detailed evidence, the investigator must understand the specific type of fraud

that has been carried out, and how the fraud has been committed. The evidence should be

sufficient to ultimately prove the identity of the fraudster(s), the mechanics of the fraud scheme,

and the amount of financial loss suffered. It is important that the investigating team is skilled in

collecting evidence that can be used in a court case, and in keeping a clear chain of custody until

the evidence is presented in court. If any evidence is inconclusive or there are gaps in the chain

26
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

of custody, then the evidence may be challenged in court, or even become inadmissible.

Investigators must be alert to documents being falsified, damaged or destroyed by the suspect(s).

Evidence can be gathered using various techniques, such as:

testing controls to gather evidence which identifies the weaknesses, which allowed the

fraud to be perpetrated;

using analytical procedures to compare trends over time or to provide comparatives

between different segments of the business;

applying computer assisted investigation techniques, for example, to identify the timing

and location of relevant details being altered in the computer system;

discussions and interviews with employees, and

substantive techniques such as reconciliations, cash counts and reviews of

documentation.

The ultimate goal of the forensic investigation team is to obtain a confession by the fraudster, if a

fraud did actually occur. For this reason, the investigators are likely to avoid deliberately

confronting the alleged fraudster(s) until they have gathered sufficient evidence to extract a

confession. The interview with the suspect is a crucial part of evidence gathered during the

investigation. The documentary evidence gathered so far together with witness testimonies can

assist in a great deal during interviews with the suspect(s)

27
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

Submission of Documentary Evidence

Evidence Packaging

All effort should be made to maintain and preserve documentary evidence in the same condition

as it was received. The evidence must not be folded, torn, stapled, marked or touched

unnecessarily, stamped, subjected to indent writing impressions, etc. Unless legal aspects or

good judgment dictate otherwise, all articles submitted as evidence should be carefully marked

for identification. These markings should be of a discreet nature so as not to injure the evidence

itself. Good judgment may dictate that the evidence itself not be marked. It should be placed in

an envelope or container that has been identified on the outside with the date, initials, case

number and other pertinent data, prior to the evidence being placed inside and sealed. The

envelope or container containing documentary evidence should not be written on, with the

evidence inside of it.

At no time should documentary evidence be beneath a sheet of paper on which you are writing.

The importance of protecting a document from indented writing impressions cannot be over

emphasized. Each item of evidence must be placed in a separate, sealed envelope or container.

When multiple items are submitted as known of the same subject, they may be submitted in the

same container. When unusual circumstances are encountered.

Evidence that is a reproduction copy of an original should not be submitted in a plastic container,

the printed areas may transfer and adhere to the surface of the container. As a general rule, paper

envelopes are preferable for all documentary evidence.

Original evidence is always preferable over reproduction copies. Certain examinations can only

be conducted with original documents. Occasionally the reproduction copy is the questioned

28
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

document. The inability to obtain original evidence should never stop the submission of

questioned items. The forensic investigation expert will examine the best evidence available.

1. Witness should initial or sign and date each page and

2. If available, samples of non-request writings should be obtained.

Latent Fingerprint Examinations

If the evidence is to be chemically treated to develop latent fingerprints, it should be submitted to

the Forensic lab first. Certain evidence may be destroyed if the document is treated for latent

prints before a document examination is performed. The Forensic lab will do all appropriate

examinations and preserve the document in its original condition. It will then either be returned

to the submitter or forwarded to the Forensic Identification team for examination, as requested

by the submitter. It is always advisable to treat all documents as though they were being

protected for latent prints examination.

Documents Examination

During document examination, the investigator should use an elderly approach to examine the

questioned documents/ materials presented. He/ she must adhere to a uniform procedure for a

systematic and thorough study of suspects documents to see to it that an important piece of

evidence is not disregarded.

Photocopies and Photographs must be made of the original documents in the quickest possible

time. Photographs safeguard the honesty of the documents/ materials by availing an accurate

copy of the items. Although enlargements often reveal evidence, which may not be without

magnification, enlarging photographs should also be done with a lot of caution. A one on one

photocopy should also be made so that the size of the document can be easily established. A

29
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

200% enlargement is useful for examination. An enlarged document is easy to examine and

extract evidence that is not possible without the enlargement.

30
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

PROGRESS TEST 3

10 multiple choice questions

1. Documentary evidence is a document presented and allowed as evidence in a hearing or

trial, but not oral testimony.
A. Yes

B. No

2. A witness is also known as

A. A victim.
B. A person that is thought to be guilty of a crime.
C. Expert witness.
D. None of the above

3. Documentary evidence collection must follow the best evidence rule, which states that if
a document is to be produced as evidence it must be in its original form
A. True

B. False

4. What is an inappropriate procedure during an interview?

A. Let the person being interviewed do the talking.
B. Conduct the interview privately.
C. Challenge answers given.
D. Create rapport with the subject of the Interview.
5. The investigator should coerce the witness to respond.

A. True

B. False

6. An interview Should precede every interrogation

A. True

B. False

7. An experienced Investigator can leave an interview or interrogation knowingly outwitted by

the witness/ suspect.
A. True

31
 All copy and transmission rights reserved by the IICFIP USA, Incorporation

B. False

8. During document examination, the investigator should use an elderly approach to examine
the questioned documents/ materials presented.

A. True
B. False
9. The investigator should base their understanding of the responses on the hypothesis
given to him.
A. True
B. False

10. The investigator retains the sole right to hide and to conceal the name of some suspects for
security reasons.
A. Yes

B. No

32