Home/Services/Digital Forensics/Document Forensics
// DOCUMENT FORENSICS

Document Forensics

Was a document created when it claims to be, and has it been changed since? We examine Word, PDF, Excel and other digital files, and the devices and accounts they came from, to establish when they were created, edited and by whom.

What We Examine

File MetadataAuthor, created and modified dates, editing time, revision counts and the software that produced the file.
Internal StructureRevision history, tracked changes, embedded objects, fonts and templates that can date a document independently of its metadata.
PDFsIncremental saves, layered edits, altered text and signature fields, and the tool that generated or modified the file.
Spreadsheets and RecordsChanges to financial records, hidden sheets and formulas, and when figures were entered or edited.
Emails and AttachmentsWhether an attachment matches the version sent, and the header and server records that date it.
The Source DeviceTraces on the computer or account the file came from: recent files, cloud versions, backups and deleted drafts.

When It Matters

  • →Contracts, variations or agreements alleged to have been backdated
  • →Letters, file notes or minutes produced late in a dispute
  • →Wills, deeds and trust documents where the digital version is in question
  • →Altered invoices, payslips and financial records in fraud and insolvency matters
  • →Employment disputes over warnings, policies or performance records
  • →Family law disclosure where records appear to have been edited

Accuracy and Limits

Metadata is easy to change, so we never rely on it alone. We test each date against the file’s internal structure, the source device and any cloud or backup copies, and report where they agree or conflict. We examine digital files; handwriting and ink on paper originals are a separate discipline, and we will tell you when you need that kind of examiner instead.

Testing a document produced by the other side? See disclosure and case review.

Related Guides

Common Questions

Can you tell if a document was backdated?+

Often. File system dates, internal metadata, template and font versions, and copies held in email or backups can show when a document was really created or changed.

Does changing the computer’s clock hide the change?+

Not usually. It alters some timestamps but leaves others untouched, and those inconsistencies are themselves evidence.

Can you examine a printed document?+

We examine the digital files behind it: the document it was printed from, earlier versions and any scans. Handwriting and ink analysis need a forensic document examiner.

Before You Call

01Keep the Original FileSend the file itself, not a printout, scan or PDF of it. Every conversion strips the evidence we need.
02Don’t Open and Re-Save ItOpening and saving a document can change its dates. Work from a copy and leave the original untouched.
03Note Where It Came FromWho sent it, when, and how: the email it arrived on, the shared drive or the USB. That source is often the best evidence.
04Keep the DevicesThe computer or account the document was made on may hold earlier versions and deleted drafts.

Have a Matter You'd Like to Discuss?

A certified examiner responds within one business day — in confidence, no obligation.

Request a Confidential Consult