> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truenroll.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Forensics & verification

> How TruEnroll detects tampered and fraudulent academic documents.

When the `forensics` feature is requested for a case, each document goes through a forensic
analysis pass. The forensics engine checks for signs that a document has been altered,
manipulated, or is otherwise not authentic, and reports its findings alongside the extraction
result.

## What forensics checks

Forensic analysis runs against the original uploaded file and the OCR output. It looks for:

<CardGroup cols={2}>
  <Card title="Tampering indicators" icon="triangle-exclamation">
    Pixel-level manipulation, copy-paste artifacts, inconsistent fonts, and metadata anomalies
    that suggest content has been modified after the document was originally created.
  </Card>

  <Card title="Consistency checks" icon="magnifying-glass">
    Internal inconsistencies: grades that don't match stated GPA, dates that contradict
    enrollment timelines, or institution details that don't match known records.
  </Card>

  <Card title="Layout analysis" icon="file-magnifying-glass">
    Structural irregularities in how the document is formatted: unofficial templates,
    missing expected fields, or layout patterns that don't match the issuing institution's
    known format.
  </Card>

  <Card title="Metadata verification" icon="circle-info">
    File metadata (creation date, software, modification history) cross-referenced against
    what the document claims to represent.
  </Card>
</CardGroup>

## Forensics result shape

The forensics result is returned per analyzed file. Once a run is `completed`, each entry
includes the structured verdict, document context, a plain-language `summary`, `topEvidence`,
and the per-check outcomes in `checks[]` — so you can consume results programmatically without
parsing the PDF:

```json theme={null}
{
  "uploadId": "6850def456ghi789abc123",
  "credentialId": "6850abc123def456ghi789",
  "fileId": "file_abc",
  "status": "completed",
  "verdict": "LOW RISK",
  "documentName": "Bachelor of Science",
  "candidateName": "Syed Muhammad Ali",
  "issuerName": "Oxford Brookes University",
  "issuanceYear": 2019,
  "summary": "Low risk. Oxford Brookes University is a recognized UK institution and the terminology aligns with official templates.",
  "topEvidence": ["Terminology and spelling match official templates."],
  "checks": [
    { "checkNumber": 1, "title": "Name & Identity", "status": "PASS", "description": "The candidate's name is consistent throughout the document." },
    { "checkNumber": 11, "title": "Digital Footprint & URLs", "status": "UNVERIFIED", "description": "No verification QR code or URL was detected." }
  ],
  "reportUrl": "https://..."
}
```

`credentialId` is `null` for raw-file forensics (uploads submitted with `classify: false`),
where `fileId` identifies the source file instead.

The rich fields (`verdict` through `checks`) are populated only once `status` is `completed`;
while a run is `queued`, `processing`, or `failed`, the entry carries just the identifiers,
`status`, and `reportUrl`. The `reportUrl` links to the full PDF report. See
[Forensics results](/partner-api/forensics-results) for the complete field reference.

<Note>
  Forensics and extraction run independently. A forensics failure does not block extraction from completing, and vice versa.
</Note>

## Enabling forensics

Forensics is an opt-in feature at the case level. Include it in the `features` array when
submitting a case:

```bash theme={null}
curl -X POST https://api.truenroll.com/partner/v1/cases \
  -H "x-api-key: $TRUENROLL_API_KEY" \
  -F "files=@transcript.pdf" \
  -F 'features=["extraction","forensics"]'
```

Your organization must have the `forensics` feature enabled. Requesting it without the
feature fails synchronously with a `403` before any files are stored or processed.

<Card title="Forensics feature limits" icon="sliders" href="/partner-api/features-and-limits">
  Organization feature requirements and behavior when the feature is unavailable.
</Card>