Forensic Tape Analysis Inc
Home contact us about us
published articles
task descriptions


Disguised Writings
Steve Cain
Board Certified Forensic Document Examiner

Paper presented at AFDE annual meeting in Milwaukee WI 1998 by Steve Cain
According to Irby Todd in his paper “The Process of Comparison”, he makes an important statement concerning an indispensable first step in examining any questioned writings. “How does one learn to establish the naturalness of writing?” (1) He continues by concluding that this writing, which is made with the least conscious attention to the structure of the writing, contains the following features:

1. Smooth, unbroken strokes and rounded forms.

2. Misplaced and misshapen i-dots and t-crosses.

3. Letters tapered illegibly toward the end of words.

4. Marked difference in pressure on upstrokes and down-strokes.

5. Delicate pressure at beginning and ending strokes to letters.

Since, generally speaking, the more rapidly the writing is made the more natural it is, the following are also indications of naturalness when found in larger bodies of writing (say, a note or letter):

6. Joining of initials or words.

7. Wide writing and spacing.

8. Simplification of forms, such as capitals.

9. Absence of approach strokes to certain letters, for example, a, f, h, t, u, v, and w.

A word of caution. Some people write rather slowly, yet naturally, and it requires considerable skill to differentiate between the natural writing of a semi-literate person and an imitation of such a person’s writing.

Reminder: In order to improve your own capability in learning to recognize natural writing, keep in mind the characteristics described above, especially the first five.

One might wonder which writing, the questioned or standard (known), should be examined first to determine if it was naturally made. As a practical matter, however, it is recommended that the questioned material be examined first on this point. Why? Because you can save yourself a considerable amount of time in the total examination.

Let’s assume that you examined the questioned material and that you determine that the writing was made with considerable deliberation, that it represents a tracing, or that it is an effort to sketch another writing. If that determination is made, you know right away that even if you examine thousands of sheets of the writing of suspects, that you are never going to be able to positively identify anyone as the writer of the questioned material.

When sketching, a forger aims to copy those features that are most striking to the eye, such as letterforms (especially capitals) and the slant of the writing. He will usually fail to note or imitate successfully the features that are relatively inconspicuous, such as relationships in size between letters or within letters.

Since both tracings and careful freehand sketches must be made slowly, they will show some simulations of most of the following conditions:

10. Slow, broken strokes, tremulous lines: a drawn appearance.

11. Unnecessary retouching of strokes or letters.

12. Blunt beginning and ending strokes.

13. Lack of difference in pressure on upstrokes and downstrokes.

14. Greater deliberation or care at the start of a name or word.

15. Awkward looking forms.

16. Meaningless blobs or marks.

17. Frequent change in the angle of writing.

18. Acute angles.

19. Difference in speed within the writing.

Reminder: Study signatures known to be forgeries by tracing or sketching. While doing so, keep in mind the characteristics described in 10 through 19.

Disguised writing attributes encompass a number of controlling factors and its success is directly related to the skill and the imagination of the subject and the amount of questioned writing involved. Most persons are able to alter some of their writing habits and most can successfully hide their identity in a small amount of writing such as single signature. However, most are unable to maintain a disguise when they have to write a large amount of material, such as an entire letter or several exemplar forms. Therefore, it can be seen that if a single signature is questioned, the writer might be able to successfully mask his identity, while his chances of being identified increases as he continues to write. It should also be seen that if the exemplars are disguised, the more exemplars you obtain the greater the chances are that some of the writings will contain some of the normal characteristics of the writer. One of the best things an investigator can do when taking exemplars is to have some non-requested specimens of the person to compare with the requested specimens. These will enable him to see if there is any obvious differences between these collected specimens and the requested writings. When most persons who are giving a disguised specimen are confronted with a naturally written specimen, they will discontinue the attempted disguise.

Some of the elements frequently found in disguised writings were identified by Ed Alford and are listed below:


An examination of these findings indicates that persons use many different methods, alone or in combination, to effect a disguise.

Unaccustomed Hand
The use of the awkward hand is treated separately because this type of disguise contains some characteristics not normally found in disguised writings by the practiced or normally used hand. The term “unaccustomed hand” means that hand with which the writer has the least skill or the hand that he used little or not at all for normal writing but might use in an emergency or for purposes of disguise.

The use of the unaccustomed hand for producing fraudulent writings, say, for writing an unauthorized endorsement on a check, is not as common as it might be, probably because the writer believes he would become conspicuous by his awkwardness, or it may be that the writer believes that the product of his unaccustomed hand can be identified as readily as the product of the other hand. In many instances, this is not true; that is, such writings often do not provide a basis for a positive identification. There are, of course, some habits that will be revealed in this class of writing, for example, size relationships within a letter and relative heights of letters and the approximate form of most letters. As will be seen, however, there are modifications of some habits and at least a partial obscuration of others.

Characteristics of writing made with the unaccustomed hand are:









At the U.S. Secret Service Questioned Document School, the following principles of disguised writing are recommended:

The Recognition of Disguise

Certain general principles of disguised handwriting may be regarded as firmly established:

1. Most disguises are relatively simple in nature.

A. Recognition of handwriting is often based upon “general pictorial effect.” (Recognition at a cursory glance).

B. General pictorial effect is almost entirely a function of a few features, such as, size; slant coupled with some obvious features in letter design.

C. Any deliberate marked change in any of the above features, particularly an alteration in slope, will have a profound effect upon the appearance of handwriting.

D. Introducing alternative forms for capital letters and for such lower case letters as “r”, “p”, and “e” will result in a radical change in general appearance of handwriting.

E. In many cases a profound alteration in slope is considered all that is necessary to render a handwriting unrecognizable.

F. Where more than a few lines of disguised writing have to be written, the intense concentration, which is essential for the maintenance of any complicated scheme of disguise, is beyond the capability of the average person.

2. Disguised handwriting exhibits less fluency and poorer rhythm than the normal hand.

Disguised handwriting, which is deliberately written in a style to which the writer has not become accustomed can not have the fluency and rhythm associated with a “normal hand”.

Handwriting can exhibit its best rhythm only when it has been executed to a great part as a reflex movement, without conscious thought having to be given to the details of its structure.

The greater the effort and concentration necessary to form the disguised script, the greater will be the extent to which it has departed from its original fluency and rhythm.

One of the features most characteristic of a forgery, (no matter how carefully the letters have been copied from the genuine signature), is the poorer rhythm and complete absence of fluency exhibited by the forgery when compared with the original. Poor line quality is a feature of disguise.
3. Any change in slope when introduced is rarely constant.

Gross alteration in slope (slant) is by far the most favored device for the disguise of handwriting in criminal cases.

A pronounced change from a forward to a back slope is more than seven times as popular as a change of slope in the reverse direction.

A “style characteristic” of most normal contemporary handwriting is the adoption of a forward slope.

While most writers are able to begin writing with a slope appreciably different from that to which they are accustomed, comparatively few are able to maintain a consistent false slope for any length of time.
4. Disguised handwriting often contains altered letter designs.

A. When there is reason to suspect that handwriting has been disguised, a thorough search should be made for alterations in letter design.

B. About 20% of those who wish to disguise their handwriting do so by substituting alternative forms for certain of their letter designs.

5. The internal consistency of handwriting is disturbed by the introduction of disguise.

Including capital letters, the alphabet may be considered to be made up of about forty different letter formations in extensive use, for little heed need be taken of such letters as “Z”, “X”, and “Q” which are rarely encountered in English handwriting. (More often used in the United States.)
Every individual letter of this fairly large number, although of unique design, is in reality constructed by combining a few of a relatively small number of structural elements.
These structural elements are the loops, arches, troughs and short straight lines from which all systems of contemporary handwriting are constructed; therefore, it is not surprising that many letter designs have much in common.
6. Disguise is rarely consistent.

With the exception of the use of the unaccustomed hand, few forms of disguise are consistently retained throughout the whole of an extended passage of handwriting.

In the writing of an extended passage, the disguise is usually relaxed toward the end:
1. Due to writer becoming tired.

2. Due to loss of concentration.

3. The final paragraphs of a disguised handwriting will bear a closer resemblance to the normal handwriting than any which have gone before; any feature which remains unchanged throughout is probably undisguised.

Certain portions of a disguised document can be counted on as having been much less thoroughly disguised than others.
1. It is rare for the handwriting on the envelope to be disguised with anything like the same thoroughness as its contents.

2. For above reason envelopes of anonymous letters should invariably be preserved for investigation.

3. It will usually be found that the arrangement of the inscription on the envelope is that favored by the writer in his normal correspondence.

a. Figures, which form part of the address on an envelope, are rarely disguised.

b. Titles, such as “Mr.”, “Mrs.”, “Dr.”, are rarely disguised with possible exception of the substitution of block letters for cursive capitals.

c. Figures found in fraudulent entries in account books and on printed forms are almost invariably disguised.

2. Certain features are rarely disguised.

A general principle which admits of no exception is that no one is capable of writing a disguised handwriting which is of higher quality with respect to fluency, rhythm and letter design than that which is normal to the writer.

A. In the majority of disguised handwritings the word spacing is almost certain to be that of the normal script.

1. Words separated by less than a width of a letter.

2. Words separated by as much as the width of four or five letters.

3. Copybook word spacing habits - about - width of two letters.

B. Writers find considerable difficulty in pruning their scripts of certain revealing features when attempting to disguise their handwriting:

1. Excessive ornamentation in the form of flourishes.

2. Underlining of words and the use of the rubric.

3. Marginal habits.

4. Line spacing.

5. Extent to which the paragraphs are indented.

6. Manner in which the writing is arranged with respect to the printed line when lined papers used.

7. Misspellings.

The aforementioned principles should aid the document examiners in 1) identifying “natural” vs. “non-natural” writing; relative speed of writing determinations; and those factors often associated with disguised writings or exemplars.

Steve Cain

Board Certified Document Examiner

forensic audio
Forensic Tape Analysis, Inc.

Phone: 1-262-348-1313
or : 1-877-292-7514
forensic video
Home / Contact Us / About Us / Published Articles / Task Descriptions / Examples / Links