Photocopier and Fax Examination, and Toner Analysis

Trash marks (also called repeating defects, ghost marks, or class artefacts in different examination traditions) are extraneous marks that appear on photocopied documents at consistent positions and intervals, arising from contamination or damage on the optical or mechanical components of the copying machine. The two most common sources are the platen glass and the photosensitive drum.

Platen glass defects arise from scratches, dust, fibres, ink, correction fluid, or adhesive deposits on the flat glass surface on which original documents are placed for scanning. Because the scanning element traverses the glass at a fixed orientation relative to the paper, a defect at a fixed point on the glass reproduces at the same position on every copy made on that machine, regardless of the document being copied. A platen glass mark appearing at a fixed position on multiple copies linked to a single fraud series is strong evidence of common machine origin. The defect can be confirmed by placing a blank sheet on the glass and making a test copy: the mark reproduces in the same position.

Drum defects arise from scratches, nicks, chemical contamination, or light-exposure damage on the photosensitive drum surface. Because the drum rotates continuously during copying, a drum-surface defect appears periodically in the copy output at intervals equal to the drum circumference, typically 75 to 120 mm for the drum designs used in office photocopiers. Multiple copies of the same document from the same machine will show the drum defect repeating at the same measured interval. In extended copying sessions producing multiple pages, the defect repeats on each page at the same inter-defect distance measured from the top margin.

Measuring trash mark positions and intervals requires a calibrated steel rule or a scanner at 600 dpi or higher with digital measurement. The position of a platen mark is recorded as (x, y) coordinates from a fixed reference corner of the copy. The period of a drum mark is recorded as the distance in millimetres between successive appearances. These measurements, taken from a questioned copy and compared against test copies made on a suspect machine, are the basis for machine-attribution in photocopier cases.

Beyond drum and platen defects, photoco

piers accumulate gear wear and roller degradation over their service lives. A worn or chipped gear tooth in the drive train produces a quasi-periodic density fluctuation whose frequency corresponds to the gear's tooth-count and rotation speed. A degraded developer roller produces uneven toner deposition that appears as horizontal banding, density streaking, or toner agglomeration artefacts. A contaminated or worn cleaning blade leaves residual toner on the drum surface, producing faint background marks (called "ghost images") of previously copied documents.

Banding analysis in photocopier examination follows the same methodology used for laser printer banding in printer identification: high-resolution flatbed scanning (1200 dpi is typically used for detailed work), digital densitometry along horizontal scan lines, and Fourier analysis to extract the periodic frequency and amplitude of density variations. The banding frequency measured from questioned copies is compared against the banding signature of known copies from the suspect machine. A consistent banding frequency and waveform shape across questioned and known copies, with other defect parameters also matching, supports attribution to the suspect machine.

Ghost imaging (a faint overlay of a previous copy's content visible in the background of a current copy) arises when residual toner from a high-density original is not completely removed by the cleaning blade before the drum is re-used. Ghost images are typically very faint and detectable only under reflected infrared illumination or through digital contrast enhancement of a high-resolution scan. They can reveal the content of documents previously copied on the machine, which may be investigatively significant when the same device was used for both the questioned document and other materials of interest.

In multi-function devices (MFDs, which combine photocopying, printing, scanning, and faxing), the hard drive of the device retains rasterised image data from recent jobs in many models. The forensic examination of this stored data follows the same chain-of-custody and imaging protocols covered under PDF metadata forensics and document image authentication. Forensic acquisition of the MFD's internal storage (using specialist tools such as the Paraben Device Seizure or vendor-specific law enforcement forensic access interfaces) can recover copies of recently processed documents directly. This digital forensic complement to physical copy-artefact examination has become standard practice in fraud investigations where a suspect MFD is seized; the UK ACPO guidelines on digital evidence and the US NIJ guidelines on electronic evidence both cover MFD hard drive acquisition.

Copy generation analysis addresses the question: is a document an original, a first-generation photocopy of an original, or a later-generation copy? The question matters when a party presents a copy as evidence of a transaction, claiming it is "the original" or "a direct copy," while the opposing party suspects the document has been copied multiple times, or that page substitution occurred between generations.

The underlying physics is well-established. Each copying generation introduces scanning resolution loss, noise amplification, and toner dot structure alteration. An original document produced by a laser printer has a toner dot structure at the resolution of the printer (typically 600 to 1200 dpi). A first-generation photocopy of that original is scanned by the photocopier's imaging system (typically 600 dpi optical resolution, sometimes lower) and reprinted. The resulting dots in the copy are not individual toner particles faithfully reproducing the original dots; they are the photocopier's toner rendering of the photocopier's scan of the original. At the second generation, the dot structure degrades further: edges become less sharp, halftone patterns develop a secondary moire pattern from the interaction of the copy dot grid with the original dot grid, and background noise (random density variation in nominally white areas) increases.

Measuring generation number in practice involves: (a) comparing background noise density (in terms of random reflectance variation in blank areas) across the questioned document against reference copies of known generation; (b) measuring line-edge sharpness at fine character strokes under microscopy; (c) examining halftone or photographic image area dot structure (moire patterning frequency increases with each copy generation). There is no bright-line threshold for "second generation vs third generation"; the examiner characterises the degradation profile and expresses an opinion on the minimum generation consistent with the observed degradation.

In civil litigation, copy generation analysis is frequently requested in contract disputes where one party claims that the version of the contract they hold is the original and the opposing party's version has been altered between generations. In probate proceedings in the UK, Australia, India, and the US, copy generation analysis on will copies has been used to detect page substitution: a fraudulently prepared page inserted into a photocopied will may show a different generation-level degradation signature from the adjacent pages.

Fax transmission over the public switched telephone network (PSTN) or VoIP follows the ITU-T T.30 protocol (for standard Group 3 fax machines) or T.38 (for fax over IP). The sending machine scans the original at a resolution determined by the transmission mode: Standard mode (200 x 100 dpi), Fine mode (200 x 200 dpi), or Super-Fine mode (400 x 400 dpi, where supported). The scanned bitmap is compressed using modified Huffman encoding (for standard resolution) or Modified Modified READ (MMR) coding (for higher quality modes) and transmitted as a serial data stream. The receiving machine decompresses and prints the stream using its own print engine.

The fax header bar is the primary jurisdictionally standardised artefact. Under US FCC regulations (47 CFR 68.318), all commercial fax machines sold or used in the US must print, at the top of each received fax page, the sender's telephone number, the sender's machine identifier (the CSID, a configurable name string), and the date and time of transmission. Similar requirements exist under UK Ofcom regulations and EU Directive 2002/58/EC (the Privacy and Electronic Communications Directive). Even if the sender attempted to suppress or forge the header content, the header bar's position, font rendering, and spacing characteristics are determined by the receiving machine's firmware, not the sender, providing a secondary class-level attribution to the receiving machine's model.

Transmission compression artefacts appear in the printed fax document as characteristic horizontal streaking (from Huffman run-length encoding artefacts at high-contrast edges), vertical resolution halving in standard-resolution mode (100 lpi scanning produces vertical stretching of fine character features), and random-error substitution artefacts (single-bit errors during noisy telephone-line transmission appear as single-pixel black lines or white gaps in the reconstructed image). These artefacts differ from photocopier banding and from inkjet dot patterns, allowing an examiner to classify a document as "fax-received" versus "photocopied" versus "original-printed."

The EAB (Electronic Address Book) data transmitted in T.30 protocol headers, the NSF (Non-Standard Facilities) frames exchanged between machines during call setup, and the CSI (Called Subscriber Identification) and TSI (Transmitting Subscriber Identification) frames in the fax session handshake are all logged in fax machine memory and in VoIP gateway logs. Law enforcement access to these logs (via warrant in the US, under the Investigatory Powers Act 2016 in the UK, under the BNSS 2023 in India) can establish the originating telephone number, the make and model of the sending machine, and the exact time of transmission independently of the header bar content printed on the received fax.

1. Document the fax header bar
   Record the sender CSID, transmission date-time, and page count from the header bar. Note any inconsistencies between header time and claimed transaction date. Photograph under oblique light to reveal any overprinting or alteration of header content.
2. Classify transmission artefacts
   Examine fine character strokes under stereo microscope at 10-20x. Identify horizontal streaking from Huffman encoding, vertical resolution loss from standard-mode scanning, and random single-pixel error substitutions. Compare against reference fax copies at known resolution modes.
3. Assess copy generation
   If the document is a fax of a photocopy (or vice versa), layer the generation analysis: photocopier degradation signature first, fax compression artefacts superimposed. Each generational step is identifiable in the degradation sequence.
4. Correlate with telephone records
   Request originating line records from the network provider (lawful process required). Cross-reference transmission time from the fax header with call records to establish whether the claimed sender line was used at that time.
5. MFD internal log acquisition
   If the receiving fax machine is a multi-function device, acquire the internal job log and, where legally authorised, the image data store. Job logs record CSID, transmission time, page count, and line-level error statistics. Image stores in some models retain rasterised received fax images.

Toner particles are the solid imaging material deposited onto paper by the electrophotographic process. Black toner consists primarily of a thermoplastic polymer binder (styrene-acrylate copolymer was dominant through the 1990s; polyester resins became dominant in the 2000s due to superior low-temperature fusibility), carbon black as the colorant, charge control agents (quaternary ammonium compounds, azo-iron complexes), and surface additives including fumed silica (for flowability and charge control) and titanium dioxide. Colour toners replace or supplement carbon black with organic pigments (phthalocyanine cyan, quinacridone magenta, azo or benzimidazolone yellow), producing additional elemental and spectroscopic markers.

FTIR spectroscopy in attenuated total reflectance (ATR) mode is the primary screening tool for toner polymer identification. The polymer absorption pattern in the 700-1800 cm-1 region distinguishes styrene-acrylate from polyester and from polyester-styrene hybrid binders. Within the polyester class, different copolymer ratios (terephthalate vs isophthalate content) produce subtle but reproducible spectral differences. Reference databases of toner FTIR spectra have been compiled by the FBI (RELAB and the Ink Library), the BKA (Germany), the Netherlands Forensic Institute (NFI), the FSS (UK, now absorbed into Forensic Science International), and the CFSL (India). In contested document cases, FTIR matching of toner from a questioned document against a reference toner class library allows class attribution of the toner type, narrowing the population of possible source machines.

SEM-EDX particle analysis provides complementary morphological and elemental data. The particle size distribution, shape factor (sphericity, surface roughness), and elemental composition (via EDX) differ between toner manufacturing processes and between generations of the same manufacturer's product. Chemically developed (wet-process) toner particles from early copiers are irregular in shape; modern chemical toner particles produced by polymerisation processes (emulsion aggregation) are more spherical and size-controlled. EDX identifies iron (from magnetite, used in single-component developer toners), chromium (from certain charge control compounds), titanium (from TiO2 surface additive), and elemental markers in coloured pigments.

Land record fraud generates substantial toner analysis casework in South Asian forensic laboratories. Disputed property documents, particularly certified copies of mutation entries, sale deeds, and registration certificates that appear to have been generated or backdated using photocopier or laser printer output inconsistent with the claimed registration date, are submitted to CFSLs and state forensic science laboratories regularly. The CFSL's document examination division uses FTIR and SEM-EDX toner analysis alongside copy generation assessment. A toner polymer formulation introduced commercially in 2005 cannot appear on a document dated 1998, and this class-level exclusion is routinely used to support fraud prosecution in sessions courts and high courts.

In Germany, the BKA's document examination department has published toner database methodology and has provided reference standards for inter-laboratory comparison exercises through the ENFSI Document Working Group. The ENFSI best practice manual for questioned document examination (published 2010, updated 2017) includes a dedicated chapter on toner and ink analysis methodology, citing validation studies from the NFI (Netherlands), the Austrian Criminal Intelligence Service (BK), and the Swedish National Forensic Centre.

In the United States, the Secret Service Forensic Services Division's Ink and Toner Reference Library, built over decades, contains samples from most commercially distributed toner cartridges marketed since the early 1980s. Law enforcement agencies in the US submit questioned documents to the Secret Service laboratory for toner class attribution as part of counterfeiting, fraud, and identity document investigations. The FBI Laboratory's counterpart unit handles cases within FBI jurisdiction, and the two agencies operate parallel databases with cross-reference coordination.