Investigating the Time of a Questioned Digital Document: a Forensics Approach

The term “Questioned Documents” covers a variety of different evidentiary questions, which extends well beyond the traditional field of the identification of questioned handwriting. It is commonplace nowadays to find the Questioned Document Examiner being asked to determine questions of authenticity in regards to not only questioned signatures but also to examine questioned typewriting, inks, writing instruments, paper, alterations of documents, erasures or other obliterations, and to determine the relative date of a particular writing. Questioned documents are usually submitted for examination purposes inasmuch as doubts have been raised concerning their 1). Origin; 2). Authenticity; 3). Age; 4). Author; 5). Circumstances under which the document may have been executed. When it comes to Digital document time is an important resource that is embedded by the OS.In this paper we have shown a method by which an investigator can establish true time of a document (document downloaded remotely) against any dispute in a court of law.