23. Documentation
Evidential confidence and reporting
A report must let the reader see how sure the examiner is of each finding, and why. The examiner grades every conclusion, states the grade, and lists the evidence that supports it and the evidence, if any, that cuts against it.
The confidence scale
- Confirmed. Supported directly by intact forensic metadata, or by independently reproducible evidence: a file recovered from an intact record, a hash match against an independently existing copy, a reconstruction reproduced by a second method to the same hash and corroborated.
- Strongly supported. Multiple independent artefacts support the conclusion and none contradicts it, but no single item proves it on its own: a reconstruction validated by structural decoding, thumbnail comparison and consistent timestamps, without an independent copy.
- Probable. The reconstruction or inference is technically coherent and consistent with the evidence, but relies in part on examiner judgement or on assumptions that could not be tested: a fragment order chosen on content continuity alone, or an interpretation that depends on the system clock being correct when no reference was recorded.
- Possible. The evidence is consistent with the conclusion but insufficient for a stronger grade, or alternative explanations remain open: a carved fragment that may belong to the file in question, an encrypted partition whose contents are unknown.
A conclusion is never graded higher than the weakest evidence it depends on. A timeline entry derived from a "probable" reconstruction is at most probable, whatever else surrounds it. Where a conclusion could be raised by evidence that was not available, say what that evidence would be.
Reporting derived material
- Never present inferred or manually reconstructed material as equivalent to an untouched original. Label it, in the text and in any exhibit list, as reconstructed, with its confidence grade and a reference to the reconstruction record.
- Present recovered fragments as separate exhibits alongside the reconstructed file, so that the reader can see what the examiner started from, and another examiner can reproduce the process.
- Report negative results and failed attempts with the same care as successes: the volume that was not decrypted, the candidate fragment that was rejected, the tool that produced an error. Omitting them is what turns an honest limitation into an apparent concealment under cross-examination.
- Report limitations explicitly: unreadable sector ranges, the memory capture footprint, tools that disagreed, assumptions that could not be tested.
- Keep the label on each statement (see the introduction): observed fact, tool-reported information, interpretation, inference or hypothesis, recovered evidence, derived artefact, conclusion with grade.
What the report must let another examiner understand
The final report is read by people who were not there and by an examiner who may repeat the work. It must state, in a form each of them can follow:
- What evidence was received: every item, with its reference, description and hash.
- Its condition on receipt: powered state, seals, damage, encryption, prior handling.
- What actions were taken, in order, with times.
- Why those actions were taken, particularly for every live interaction and every departure from the standard order.
- What tools were used, with versions, configuration and, for anything run on a live system, the executable hash.
- How integrity was verified: hashes at acquisition, verification results, re-verification before analysis.
- What was recovered, and from where.
- What was reconstructed, by what method, with reference to the reconstruction records.
- What could not be recovered: encrypted volumes not opened, unread sectors, carving that produced nothing usable, attempts that failed.
- What limitations applied: to the acquisition, to the tools, to the examiner's time and scope.
- Which conclusions are factual, resting on observed facts and intact metadata.
- Which conclusions involve interpretation or inference, and the confidence assigned to each.
Where evidence is incomplete, corrupted, encrypted, reconstructed or otherwise uncertain, the report says so in the finding it affects, not in a general caveat at the end.
Structure of a finding
Each material finding in the report should be able to stand as a unit: the question it answers; the conclusion and its grade; the observed facts with their locations in the image; the interpretation of those facts and the basis for it; the derived artefacts involved and where their reconstruction records are; the corroborating and contradicting evidence; and the limitations. A reader who accepts the facts, follows the interpretation and checks the records should arrive at the same grade.
Example. "Finding 4. A JPEG image (exhibit D-12, SHA-256 H1) depicting the subject matter was present on the data volume. Confidence: confirmed. Basis: the image was reconstructed from clusters 118,204 to 118,215 and 118,301 to 118,309 of the decrypted data volume (record R-7); the reconstruction was reproduced independently to the same hash (record R-8); a file with hash H1 exists in the cloud export (exhibit C-3). Limitations: no filesystem record for the file survives, so its original name and path are not known; the EXIF timestamp of 19:15 is consistent with the removable media activity in finding 3 but has not been independently verified."