Forensics & verification

When the forensics feature is requested for a case, each document goes through a forensic analysis pass. The forensics engine checks for signs that a document has been altered, manipulated, or is otherwise not authentic, and reports its findings alongside the extraction result.

What forensics checks

Forensic analysis runs against the original uploaded file and the OCR output. It looks for:

Tampering indicators

Pixel-level manipulation, copy-paste artifacts, inconsistent fonts, and metadata anomalies that suggest content has been modified after the document was originally created.

Consistency checks

Internal inconsistencies: grades that don’t match stated GPA, dates that contradict enrollment timelines, or institution details that don’t match known records.

Layout analysis

Structural irregularities in how the document is formatted: unofficial templates, missing expected fields, or layout patterns that don’t match the issuing institution’s known format.

Metadata verification

File metadata (creation date, software, modification history) cross-referenced against what the document claims to represent.

Forensics result shape

The forensics result is returned per analyzed file. Once a run is completed, each entry includes the structured verdict, document context, a plain-language summary, topEvidence, and the per-check outcomes in checks[] — so you can consume results programmatically without parsing the PDF:

{
  "uploadId": "6850def456ghi789abc123",
  "credentialId": "6850abc123def456ghi789",
  "fileId": "file_abc",
  "status": "completed",
  "verdict": "LOW RISK",
  "documentName": "Bachelor of Science",
  "candidateName": "Syed Muhammad Ali",
  "issuerName": "Oxford Brookes University",
  "issuanceYear": 2019,
  "summary": "Low risk. Oxford Brookes University is a recognized UK institution and the terminology aligns with official templates.",
  "topEvidence": ["Terminology and spelling match official templates."],
  "checks": [
    { "checkNumber": 1, "title": "Name & Identity", "status": "PASS", "description": "The candidate's name is consistent throughout the document." },
    { "checkNumber": 11, "title": "Digital Footprint & URLs", "status": "UNVERIFIED", "description": "No verification QR code or URL was detected." }
  ],
  "reportUrl": "https://..."
}

credentialId is null for raw-file forensics (uploads submitted with classify: false), where fileId identifies the source file instead. The rich fields (verdict through checks) are populated only once status is completed; while a run is queued, processing, or failed, the entry carries just the identifiers, status, and reportUrl. The reportUrl links to the full PDF report. See Forensics results for the complete field reference.

Forensics and extraction run independently. A forensics failure does not block extraction from completing, and vice versa.

Enabling forensics

Forensics is an opt-in feature at the case level. Include it in the features array when submitting a case:

curl -X POST https://api.truenroll.com/partner/v1/cases \
  -H "x-api-key: $TRUENROLL_API_KEY" \
  -F "files=@transcript.pdf" \
  -F 'features=["extraction","forensics"]'

Your organization must have the forensics feature enabled. Requesting it without the feature fails synchronously with a 403 before any files are stored or processed.

Forensics feature limits

Organization feature requirements and behavior when the feature is unavailable.

​What forensics checks

Tampering indicators

Consistency checks

Layout analysis

Metadata verification

​Forensics result shape

​Enabling forensics

Forensics feature limits

What forensics checks

Forensics result shape

Enabling forensics