A disputed document, a suspicious contract, a backdated letter, a curiously convenient email, is a routine feature of commercial and family work. Modern document forensics can usually give a defensible answer on authenticity, provided the right version is available for examination.
What examiners look at
- Embedded metadata, including revision history, author and time zone anomalies.
- Font, rendering and layout inconsistencies invisible on a printed copy.
- Object streams and hidden revisions in PDF files.
- Where the document came from: the mailbox, the file system, the storage account.
What to preserve
The native file, not a print or a scan. The mailbox or storage location it came from, in its original state. A screenshot of a Word document is not a document; it is a picture of one, and it will not survive scrutiny.