Before computers, forging documents required careful attention and expertise. Now, someone with rudimentary computer skills can alter an email, change the text of an electronic document, or backdate documents or communications. Stroz Friedberg has found that parties to contracts, litigants, and even lawyers find that the temptation to create or change evidence can be too hard to resist. Luckily, even when sophisticated computer users forge or alter electronic documents, a trail of digital evidence may be left and can be reconstructed by Stroz Friedberg’s digital forensics examiners.
Stroz Friedberg has uncovered proof of e-forgery using a variety of creative analytical approaches. Stroz Friedberg has detected e-forgeries when the forger created a backdated document or e-mail not realizing that metadata revealed the file was created with a version of software that did not exist on the backdated date. Stroz Friedberg has also found that persons who tamper with electronic documents received from another party often perfect the fraudulent language through multiple drafts before settling on the final fraudulent formulation. In such cases, the forensic recovery of the interim drafts often proves the fraud, as the receiving party should have no interim drafts of an e-mail sent by someone else. Backdating cases are often proven by forensically time-lining many artifacts from the computer on which the backdating occurred. Typically, the fraudster backdates his computer clock to the desired year and then creates the fraudulent document so that the “created” date of the document’s metadata matches the desired, fraudulent date. Unbeknownst to most fraudsters, such clock-tampering affects other artifacts on the computer and the residue of those effects can be strong proof of the backdating.
Document forgery and backdating are serious offenses and discovery of this conduct can have dispositive effects in civil matters. In criminal matters, defense counsel may wish to test the authenticity of documents that, for example, a client claims were created contemporaneously with the acts under investigation and that are highly exculpatory. Testing the authenticity of a document is best performed before proffering to the government and risking the embarrassment, or worse, that the document is forged or backdated. Similarly, prosecutors may wish to authenticate electronic documents that are highly inculpatory and that the defendant claims were faked. In all cases, Stroz Friedberg applies the same neutral, scientific methodology to analyze all available computers on which the potentially fraudulent file was created, edited, saved, or modified.