According to Jovan Hutton Pulitzer, official ballots have unique characteristics that can be identified forensically. Even ballot images, as well.
Printers leave code on the paper, invisible to the naked eye, that identifies the printer.
Biggest key is to sse if ballot has been folded. Official mail in ballots go through rollers during mail processing, and those folds alter the paper fiber (wood fiber). That can be seen using certain instruments. Might be the UV lights, not sure.
Also, a ballot marked in ink with have marks of different density, made when a voter pushes down on the pen to mark and then releases pressure to lift the pen. Machines don't have that. or if a ballot marking image was made to simulate a human mark, it won't be in enough variations to be credible.
The hand on audit's job is to determine which ballots were fraudulent.
The only pristine ballots should be ones in which the original, folded ballot was not legible or machine readable, and were adjudicated. They should have the original along with them, I think. Also, historically, the number of adjudicated ballots in an election is less than 1%.
Goal is not to prove machine algorithms were in play, rather to prove the machine tally did not match the valid ballot tally.