Guidelines to assist the investigation at the preliminary stages of document examination are presented. The case study describes the circumstances in which a document leak may occur and the source of potential evidence when attempting to determine the origin of the disclosure. Investigations involving unauthorized disclosures of sensitive documents are characterized by high intensity and relatively short duration. Evidence collection and procedures involved in document examination are described. In order to be effective, the document examiner must be well aware of the facts of the particular case and must be close to the activities of the investigation. 10 figures