What is Digital Document Forensics?

Digital Document Forensics (DDF) is the practice of analysing digital images or photos, files and documents for information that has been hidden or manipulated.

Why is DDF important?

Digital Document Forensics is an important part of investigations and customer verification, as it provides greater assurance that files haven’t been tampered with or forged. It can also uncover data hidden in files which can help further investigations.

Digital Document Forensics has two main uses:
• To identify the ‘provenance’ of a file – the ‘who, what, where, when, how’ of the file’s creation.
• To identify whether someone has manipulated or altered a file after its original creation.

Often, investigators will want to verify both the provenance of the document at hand as well as discover whether it has been changed in any way since creation.

DDF in practice

An example of DDF in practice would be a verification agent receiving a photograph of a customer’s passport for KYC purposes. They notice that something seems a little bit off about the passport photo. Using digital document forensic methodologies, they uncover that the photo has been altered, and the headshot photo is actually copied from another image. They also manage to uncover that the author of the photograph is different from the name on the photograph.

Another example might be using digital document forensics methodologies to analyse a scanned utility bill. The investigator uncovers that whilst the utility bill states that it is dated this month, the file was actually created two years ago and has been altered to fit different customer details.

Who can use DDF?

Digital document forensic methodologies are useful for anyone involved in checking digital documents or images for fraud/manipulation.

This includes:
• Customer verification or KYC agents
• Anti-Money laundering (AML) investigators
• Counter Fraud investigators
• Border/immigration officers
• Anyone involved in verifying documents

There is a wide variety of methodologies which can require different levels of expertise involved in Digital Document Forensics, but many are accessible to anyone with some technical knowledge and an inquisitive nature.

Training

If you would like to learn how to conduct Digital Document Forensics, Peter Darby Associates provides certificated online and classroom training for the public and private sector through our ‘Digital Document Fraud’ course.
To find out more, go to: Digital Document Fraud