01The eight parts
01Cover and case identity
Say what this report is and which matter it belongs to.
- Case or file number, requesting authority, examiner, laboratory, date.
- A unique report identifier and version number.
Guards againstAn undated or unnumbered report cannot be tied to a version or a revision history.
02Authority and scope
State under what authority the work was done and the questions it was asked to answer.
- The court order, instruction or consent relied on.
- The exact questions put to the examiner, quoted.
Guards againstA report that answers more than it was asked, or strays outside the authority, undermines itself.
03Evidence received
List every item examined and prove it is what was seized.
- Each item with its evidence number, description, acquisition hash and the form that accompanied it.
- The chain-of-custody summary and the state of seals on receipt.
Guards againstA hash recorded but never verified, or a gap in custody, leaves the evidence open to challenge.
04Methods and tools
Make the work reproducible.
- Each tool with its exact version, and the method applied for each class of artifact.
- Any validation relied on, and known limitations of a tool for this evidence.
Guards against"Analysed with a forensic tool" is not reproducible; the version and method decide the result.
05Findings
State what was observed, separately from what it means.
- Each observation tied to its source artifact, file and offset or event, with times in UTC.
- A confidence level for each interpretive statement and the basis for it.
Guards againstMerging observation and interpretation hides where the data ends and the examiner's inference begins.
06Limitations
State plainly what the evidence cannot show.
- Missing evidence, disabled logging, altered clocks, gaps and their causes.
- Questions that could not be answered and why.
Guards againstOmitting limits is the most common way a report overstates; a non-finding is not an absence.
07Conclusion
Answer each question asked, at the confidence the evidence supports.
- A direct answer to each scope question, with its confidence level.
- No new evidence; the conclusion only draws together the findings.
Guards againstA conclusion that introduces facts not in the findings cannot be traced back and should be distrusted.
08Appendices and reproducibility
Give a reader the material to check the work.
- Hash lists, tool logs, extracted artifacts, the full timeline and the forms used.
- Enough that an independent examiner could repeat the key steps.
Guards againstConclusions without the underlying material ask the reader to take the examiner's word for it.
02Confidence scale
Every interpretive statement in a report carries one of these four levels. The same scale runs through the case studies.
| Level | Meaning | Phrasing |
|---|---|---|
| Established | Several independent records agree and a tested innocent explanation does not fit. | "The records establish that…" |
| Probable | Supported and more likely than the alternatives, but on fewer or partly dependent records. | "The evidence makes it probable that…" |
| Possible | Consistent with the evidence but not established; other explanations remain open. | "The evidence is consistent with…, but does not establish it." |
| Undetermined | The evidence does not allow a conclusion either way. | "The evidence does not allow a conclusion on…" |
03Honest phrasing
Tying an action to a person
Overstates"The suspect copied the files to the USB drive."
Honest"The engineer's interactively logged-on account was used to access the files from the removable volume; the records attribute the activity to the account, not to a named person."
Logs attribute to accounts; a person is a separate inference that needs more than the log.
Cell-site location
Overstates"The phone was at the address at 14:20."
Honest"At 14:20 UTC the phone used a cell whose coverage sector includes the address and also spans roughly 1.8 km² around it; the phone was within that area."
A cell is an area, not a point; stating a point claims precision the data does not have.
Deleted data not recovered
Overstates"There were no messages before that date."
Honest"Messages before that date could not be recovered because their database pages had been reused; this is a gap, not evidence that no messages existed."
Non-recovery and non-existence are different; conflating them overstates.
Timestamps
Overstates"The document was created on the date it shows."
Honest"The document's editable created field shows that date, but the application version and the package entry times are later; the file was created later than the date it bears."
An editable field is one source; a conclusion rests on sources that cannot easily be aligned.
04Report checklist
- Every finding carries its source artifact, file/offset or event, and a UTC time with the original value.
- Observation and interpretation are in separate statements.
- Every interpretive statement has a confidence level and a basis.
- The limitations section names missing evidence, disabled logging and altered clocks.
- Non-findings are written as gaps with their cause, never as proof of absence.
- The conclusion answers each scope question and introduces no new facts.
- Tools are named with exact versions; the key steps could be reproduced from the appendices.
- A second examiner read the report against the evidence before it was issued (peer review).