OCR-Assisted Document Evidence Triage: A Forensic Examiner Workflow for Scanned PDFs and Image Files

Why OCR Triage Still Matters in 2026 Forensic Practice

Born-digital documents dominate modern forensic engagements but scanned evidence remains common in three recurring contexts. First, historical case files. Civil litigation involving events from before 2015 routinely surfaces documents that were originally paper and subsequently scanned for storage. The scanned copies may carry decisive evidence but without searchable text they are impractical to review at scale. Second, regulator submissions. Many Canadian regulator filing systems accept paper and scanned submissions in parallel with digital filings. Forensic investigation into regulator interactions often requires reviewing the scanned submissions to confirm what was actually filed and when. Third, court records. Provincial court record systems vary widely in digital availability. Older court records, particularly from criminal proceedings and from rural court registries, are routinely paper-only and require scanning before forensic analysis.

For investigators handling any of these contexts the OCR triage workflow is the load-bearing step that transforms image-based documents into searchable forensic evidence. The Sherlock OCR Reader handles the workflow in a single tool with the chain of custody discipline appropriate for litigation contexts.

Step 1: Acquire the Scanned Document File

Forensic acquisition of scanned document evidence follows the standard rules: image the source device when possible, extract the file when full device imaging is not justified, document the acquisition step in the case log. Scanned documents typically arrive as PDF (image-only PDF or mixed image and text PDF), TIFF (multi-page TIFF is common for court records), JPEG (single-page or as part of a folder) or PNG (less common but seen). The first triage step is confirming whether the document is image-only by attempting text selection on a sample page. If no text is selectable the document is scanned imagery without an embedded text layer and needs OCR.

For documents arriving on physical storage media (CD-ROM, DVD, external drive) the acquisition includes a forensic image of the source media and per-file hash records. For documents arriving via secure file transfer (regulator portal download, encrypted email attachment) the acquisition includes the transfer record and the per-file hash at the moment of receipt. The chain of custody discipline starts at the moment of acquisition regardless of the source channel.

Step 2: Hash and Chain of Custody

Compute SHA256 of the source document file before any analysis. Record the hash, the acquisition timestamp (UTC and local), the source channel, the examiner identity and the case number into the chain of custody log. Document the working-copy hash separately if you are operating on a copy. The Sherlock hash verifier produces a signed acquisition record suitable for litigation submission.

For investigations heading toward Canadian civil or criminal court the chain of custody documentation needs to satisfy the evidentiary standards in the relevant jurisdiction. The Canada Evidence Act and the provincial evidence acts have specific requirements for digital evidence authentication. The chain of custody for scanned documents is identical in principle to other digital evidence but the workflow steps differ because the OCR transformation produces a derivative artifact (the searchable text layer) that itself needs hash documentation.

Step 3: OCR With Sherlock OCR Reader

Open the working copy of the document in Sherlock OCR Reader. The tool launches without requiring an external OCR engine installation (no Tesseract install, no ABBYY install, no Adobe Acrobat Pro license). The first-load operation extracts the OCR text layer using the embedded OCR engine and produces the page-by-page rendered preview alongside the OCR confidence indicators. For multi-page documents (court records typically 50 to 500 pages, regulator filings sometimes 1000+ pages) the first-pass OCR completes in approximately 2 to 4 minutes per 100 pages on modern forensic hardware.

The OCR engine handles typed text reliably and handwritten content with degraded confidence. The page-by-page confidence indicator surfaces pages where the OCR result is suspect and warrants examiner review. For court records with original handwriting and typewritten content mixed on the same page the examiner workflow reviews the low-confidence pages manually and accepts the high-confidence OCR for the typewritten portions.

Step 4: Extract Searchable Text

Apply keyword search across the OCR text layer to identify the in-scope pages and passages for the investigation. Sherlock OCR Reader supports compound keyword filters across multiple terms with proximity operators. For example: keyword payment WITHIN 5 words of vendor reveals payment-vendor proximity matches; keyword acquisition NOT WITHIN same page as approved reveals acquisition references without nearby approval language. The filter pane shows matching pages with surrounding context and the per-page hit count.

For large documents the filter step is the workflow component that delivers most of the value. A 500-page scanned regulator filing may contain 1000 to 5000 page-level matches across the keyword set; the in-scope subset for a specific investigation might be 20 to 50 pages. The filter reduces the manual review burden by two orders of magnitude. The exported filter set carries the original page imagery and the OCR text and the case log reference.

Step 5: Export to PDF and CSV

Export the in-scope pages to PDF and the keyword hit summary to CSV. The PDF export preserves the original scanned image fidelity and adds the OCR text layer underneath the image. This produces a searchable PDF that downstream review tooling (Relativity, Logikcull, Disco, Everlaw, Canadian-specialized review platforms) can ingest and search natively. The CSV summary lists the per-keyword hit count, the matched page numbers and the page-level confidence score for each match.

For Canadian civil litigation the most common downstream format is searchable PDF for review platform ingest and CSV for evidence inventory. For criminal litigation the same outputs apply and the chain of custody documentation needs to cover the OCR transformation step explicitly. The Sherlock OCR Reader output is structured to support both downstream contexts without additional examiner work.

The Common Failure Mode This Workflow Prevents

The failure mode the workflow prevents is the manual review of image-based documents page by page. Investigators who attempt manual review on a 500-page scanned regulator filing typically take 8 to 12 hours of examiner time and produce inconsistent findings because the human reviewer cannot reliably keyword-scan across that volume. The OCR triage workflow completes the same effective review in approximately 35 minutes and produces a documented chain of custody.

For organizations handling document evidence at scale the operational discipline is to standardize the OCR triage workflow across the team and apply it as a routine intake step for any scanned document. The Sherlock OCR Reader storefront documents pricing and licensing for organizations that want to build internal capacity. For organizations needing engagement work Sherlock Forensics applies the same methodology as part of the standard forensic engagement scope.