Forensic Reference
Red Flags in Document Integrity
A practitioner's guide to the indicators that warrant forensic examination. These patterns do not confirm fraud — they signal that deeper analysis is warranted.
Document fraud rarely announces itself. It hides in the margins — in a timestamp that predates the software that created it, a font that didn't exist when the document was supposedly signed, or metadata that contradicts the narrative on the page. The following indicators are drawn from forensic practice and are organized by document layer.
Metadata Anomalies
Metadata is the invisible record embedded in every digital file. It captures creation dates, modification history, authoring software, and device identifiers — and it is rarely scrubbed completely.
Creation date postdates purported signing date
A document claimed to have been executed in 2019 whose metadata shows a creation date of 2022 is a primary indicator of backdating.
Author field names an unexpected party
The embedded author name does not match the purported drafter, suggesting the document originated elsewhere.
Software version inconsistency
The document was allegedly created before the software version recorded in its metadata was released.
Revision history shows suspicious gaps or deletions
Missing revision increments or a revision count of 1 on a complex document may indicate the history was cleared.
Timestamp Irregularities
Timestamps embedded in documents, email headers, and file systems can be manipulated — but manipulation leaves traces that forensic analysis can surface.
File system timestamps inconsistent with document metadata
When the operating system's last-modified date contradicts the internal document timestamp, one has been altered.
Timestamps in a non-local time zone without explanation
A document purportedly executed in Washington state showing UTC+8 timestamps warrants examination.
Sequential timestamps that are implausibly precise
A series of documents timestamped seconds apart across multiple signatories suggests batch creation rather than organic execution.
Font & Typography Inconsistencies
Fonts are versioned software. A document cannot contain a font that did not exist at the time it was purportedly created.
Font version postdates document execution date
Specific font versions are released on known dates. A document using a 2021 font release cannot have been created in 2018.
Mixed font rendering within a single paragraph
Subtle shifts in character spacing, weight, or rendering within a continuous block of text may indicate inserted or substituted content.
Signature block uses a different font family than the body
When the signature block was added separately from the document body, font inconsistencies often appear.
Billing & Record Anomalies
Billing records and medical records are among the most commonly falsified documents in civil litigation. Forensic review focuses on internal consistency and chronological integrity.
Billing codes that did not exist on the date of service
CPT and ICD codes are updated annually. A code billed for a 2017 service that was not introduced until 2020 is a direct indicator of record alteration.
Records added or modified after a complaint was filed
Metadata showing modification dates that follow the initiation of litigation is a significant red flag.
Chronological gaps in otherwise continuous records
Missing entries in a billing or treatment record that align with disputed events warrant close examination.
Uniform formatting across records that span multiple years
Authentic records accumulate formatting variations over time. Suspiciously uniform formatting across a multi-year record set may indicate reconstruction.
Structural & Formatting Signals
Document structure carries its own forensic record. Authentic documents evolve through drafting; fabricated documents are often created in a single session.
Revision count of 1 on a complex multi-page document
A lengthy contract or report with a revision count of 1 suggests it was created in a single session — inconsistent with authentic drafting processes.
Embedded objects or images with independent metadata
Images or embedded files within a document carry their own metadata, which may contradict the host document's claimed provenance.
Print-to-PDF artifacts on a document claimed to be original
Certain PDF creation methods leave identifiable artifacts. A document claimed to be an original signed instrument that shows print-to-PDF artifacts warrants scrutiny.
Important Note
The presence of one or more of these indicators does not establish fraud. Each flag must be evaluated in context, against the full document record, and with consideration of innocent explanations. Forensic conclusions require systematic analysis by a qualified examiner.
Identified a Red Flag?
If you have encountered one or more of these indicators in documents relevant to your matter, a forensic audit can determine whether the anomaly is significant and document the findings for legal proceedings.
Request a Forensic Audit