A modern office document is not a page — it is an archive of XML parts, an image cache, a revision journal, and a set of metadata streams the author almost never sees. A PDF is a tree of object streams with its own edit history. In both cases the record of how the document came to exist sits inside the file, and it is that internal record — not the visible content — that a document examiner is asked to interpret. The technical work is well established; what governs the outcome is whether the native file has survived long enough to be examined.
What examiners look at
| Class of evidence | What it shows | Present in |
|---|---|---|
| Core metadata | Author, last-modified-by, creation and last-saved times, revision number, editing time. | Word, Excel, PowerPoint (.docx, .xlsx, .pptx). |
| Revision history / tracked changes | Edits accepted, rejected, or retained inside the file. | Word (settings.xml, tracked changes). |
| Embedded object cache | Images and objects that were once in the file and later removed. | Office archives — sometimes retained in media/ or embeddings/. |
| Font, rendering and layout signatures | Inconsistencies invisible on a printed copy — swapped fonts, off-grid alignments. | All formats after export/print/scan. |
| PDF object streams and incremental updates | Every save appended to the file; earlier states recoverable. | PDFs saved without linearisation or scrubbing. |
| Digital signatures / DocuSign audit trail | Cryptographic proof of state at sign time and subsequent invalidation on edit. | Signed PDFs, DocuSign / Adobe Sign envelopes. |
| Provenance metadata | Where the file came from — mailbox, storage account, USB — including timestamps of arrival. | Host file system, mail store, cloud audit log. |
The alterations that leave the clearest traces
- Backdating: changing the visible date on a document without also changing the file-system creation and modification stamps — the two will diverge.
- Content substitution: replacing a paragraph, leaving the surrounding revision number, editing-time counter, and image cache inconsistent with the visible content.
- Cut-and-paste of signature blocks: font and rendering signatures rarely match the surrounding text.
- PDF re-save: an incremental save leaves earlier object streams recoverable; a scrubbed re-save leaves a signature of the scrubber itself.
- Screenshot round-trip: capturing text as an image to hide the metadata — usually visible in font aliasing and DPI mismatches.
The single most common failure in document disputes is producing the document as a PDF-of-a-print-of-a-screenshot — three lossy conversions that strip out the very metadata that would resolve the dispute. Preserve the native.
What to preserve, and how
- 01Preserve the native. The .docx / .xlsx / .pdf as it exists in the mailbox, file share or storage account — not a print, not a scan, not a screenshot.
- 02Preserve the container. The mailbox item, the SharePoint version history, the OneDrive audit log — the record of where the document came from and when.
- 03Do not open the file to check it. Opening in Word can update timestamps and rewrite portions of the archive. Copy first, examine the copy.
- 04Hash on preservation. SHA-256 of the file at the point of collection, recorded in the continuity note.
- 05Instruct on the specific question. 'Was this contract created on the date it bears?' is answerable; 'is this a real contract?' is not.
What we cannot always tell
Whether the author intended the document to mislead. Who was sitting at the keyboard on a given day, absent corroborating evidence. Whether a change was authorised or unauthorised. The report answers technical questions — when the file was created, when it was modified, what was changed, what was removed — and leaves the inferential questions to the tribunal, with the evidence in front of it.
Frequently asked questions
Usually, yes — through the divergence between the internal Office metadata, the file-system timestamps, and any surviving mailbox or storage provenance. The strength of the conclusion depends on how many of those sources are still available.
The scan strips most metadata, but font, alignment and image-processing signatures often reveal the source. A comparison with the original digital file, where obtainable, is usually decisive.
It guarantees that the signed state has not been altered since signing, and it identifies the signer's certificate. It does not guarantee that the underlying content is truthful — only that this exact state was what was signed.
Often, yes — incremental saves leave earlier states inside the file. Even scrubbed PDFs frequently leave a signature of the scrubbing tool that is itself evidentially useful.
The examination is materially weaker, and the report will say so. Font, layout and rendering analysis can still be informative, but the native file is worth an order of magnitude more.