16. Confidence, reporting and defensibility

Credibility comes from reproducibility, not assertion. The report is where all the careful work either shows or disappears, and the other side will read it looking for the gap.

The quick version

Grade every conclusion: confirmed, strongly supported, probable or possible.
Never grade higher than the weakest evidence the conclusion depends on.
Label derived material as derived, and put the fragments beside it as exhibits.
Report failures and limitations in the finding they affect, not in a caveat at the end.
Write the record so another examiner can repeat the work from the same image, tools, offsets and method.

Open this when: you are writing up findings, preparing for peer review, or getting ready to give evidence.

In this chapter

Evidential confidence and reporting (section 23)
Court defensibility and reproducibility (section 24)

23. Documentation

Evidential confidence and reporting

In short: the reader must see how sure you are of each finding, and why.

Grade every conclusion, state the grade, and list the evidence that supports it and the evidence, if any, that cuts against it.

Grade on this scale

Grade	Meaning	For instance
Confirmed	Supported directly by intact forensic metadata, or by independently reproducible evidence.	A file recovered from an intact record; a hash match against an independently existing copy; a reconstruction reproduced by a second method to the same hash and corroborated.
Strongly supported	Multiple independent artefacts support the conclusion and none contradicts it, but no single item proves it on its own.	A reconstruction validated by structural decoding, thumbnail comparison and consistent timestamps, without an independent copy.
Probable	Technically coherent and consistent with the evidence, but relies in part on examiner judgement or on assumptions that could not be tested.	A fragment order chosen on content continuity alone; an interpretation that depends on the system clock being correct when no reference was recorded.
Possible	Consistent with the evidence but insufficient for a stronger grade, or alternative explanations remain open.	A carved fragment that may belong to the file in question; an encrypted partition whose contents are unknown.

The weakest link sets the grade

A conclusion is never graded higher than the weakest evidence it depends on. A timeline entry derived from a "probable" reconstruction is at most probable, whatever else surrounds it.

Where a conclusion could be raised by evidence that was not available, say what that evidence would be.

Report derived material honestly

Never present it as an original. Inferred or manually reconstructed material is not equivalent to an untouched original. Label it, in the text and in any exhibit list, as reconstructed, with its confidence grade and a reference to the reconstruction record.
Show the fragments. Present recovered fragments as separate exhibits alongside the reconstructed file, so the reader can see what you started from and another examiner can reproduce the process.
Report failures like successes: the volume that was not decrypted, the candidate fragment that was rejected, the tool that produced an error.
State limitations explicitly: unreadable sector ranges, the memory capture footprint, tools that disagreed, assumptions that could not be tested.
Keep the label on each statement (see the language of findings): observed fact, tool-reported information, interpretation, inference or hypothesis, recovered evidence, derived artefact, conclusion with grade.

Stop and think

Omitting negative results is what turns an honest limitation into an apparent concealment under cross-examination.

Cover what another examiner needs

The final report is read by people who were not there and by an examiner who may repeat the work. It must state, in a form each of them can follow:

Evidence received: every item, with its reference, description and hash.
Condition on receipt: powered state, seals, damage, encryption, prior handling.
Actions taken, in order, with times.
Why they were taken, particularly for every live interaction and every departure from the standard order.
Tools used, with versions, configuration and, for anything run on a live system, the executable hash.
How integrity was verified: hashes at acquisition, verification results, re-verification before analysis.
What was recovered, and from where.
What was reconstructed, by what method, with reference to the reconstruction records.
What could not be recovered: encrypted volumes not opened, unread sectors, carving that produced nothing usable, attempts that failed.
What limitations applied: to the acquisition, to the tools, to the examiner's time and scope.
Which conclusions are factual, resting on observed facts and intact metadata.
Which conclusions involve interpretation or inference, and the confidence assigned to each.

Put caveats where they bite

Where evidence is incomplete, corrupted, encrypted, reconstructed or otherwise uncertain, say so in the finding it affects, not in a general caveat at the end.

Build each finding as a unit

Each material finding should stand on its own, with:

The question it answers.
The conclusion and its grade.
The observed facts, with their locations in the image.
The interpretation of those facts and the basis for it.
The derived artefacts involved, and where their reconstruction records are.
The corroborating and contradicting evidence.
The limitations.

A reader who accepts the facts, follows the interpretation and checks the records should arrive at the same grade.

Example

"Finding 4. A JPEG image (exhibit D-12, SHA-256 H1) depicting the subject matter was present on the data volume. Confidence: confirmed. Basis: the image was reconstructed from clusters 118,204 to 118,215 and 118,301 to 118,309 of the decrypted data volume (record R-7); the reconstruction was reproduced independently to the same hash (record R-8); a file with hash H1 exists in the cloud export (exhibit C-3). Limitations: no filesystem record for the file survives, so its original name and path are not known; the EXIF timestamp of 19:15 is consistent with the removable media activity in finding 3 but has not been independently verified."

Before you move on

Every conclusion graded, with supporting and contradicting evidence listed.
No grade higher than the weakest evidence behind it.
Derived material labelled, fragments exhibited, failures and limitations reported.
Each finding stands as a unit: question, conclusion, facts, interpretation, artefacts, evidence, limitations.

24. Documentation

Court defensibility and reproducibility

In short: another competent examiner, with your materials and your record, must reach the same result.

Forensic credibility does not come from the examiner's certainty, qualifications or manner. It comes from someone else being able to take the same materials, follow the same record, and arrive at the same result. Everything in this guide serves that test.

Give a reviewer what they need to reproduce it

For every material finding, the examination record must let a second examiner reproduce the work using:

The same forensic image, identified by its hash, together with the memory capture, the ddrescue map and any decrypted volume, each with its hash and the record of how it was produced.
The recorded tools and versions, with executable hashes where they were recorded, and the configuration or command line used at each step.
The same source offsets or clusters: every location in the image that a finding depends on, stated precisely enough to be opened in a hex viewer.
The documented reconstruction method, including manual decisions and their reasons, so the second examiner can make the same decisions or see where they would have decided differently.
The original fragments and derived artefacts, retained as exhibits with hashes, so the assembly can be repeated and the result compared.

Rest on four pillars

Pillar	What it means
Contemporaneous notes	Written at the time, in sequence, never rewritten, with corrections as dated additions. They are the primary record; the report is a summary of them. Expect to produce them.
Chain of custody	Unbroken from seizure to court for every physical item and every digital exhibit (section 10).
Cryptographic hashes	For the original, the master, each working copy, each derived artefact, each fragment and each tool. A hash recorded at the time is the only proof that what is presented is what was acquired.
Transparent reporting of uncertainty	Every limitation, every failed attempt, every assumption and every grade below confirmed, stated in the report rather than discovered in cross-examination.

Make it hold up in practice

Write the record as you go, as if the second examiner were reading over your shoulder. If a step cannot be written down clearly enough to repeat, it is not finished.
Get material findings peer-reviewed before the report is issued, by an examiner who works from the record rather than from a conversation with you. If they cannot reproduce a result, that is a defect in the record, to be fixed before it is relied on.
Validate tools before relying on them: know what a tool does with corrupt input, whether it modifies what it mounts, and where its documented limitations are. Keep validation records.
Know your duty to the court. In England and Wales, an expert witness owes a duty to the court that overrides any obligation to the instructing party, and must state the facts and assumptions a conclusion rests on and anything that might undermine it. The disciplines in this guide are how that duty is discharged in practice.
Write for the other side. Expect them to have a competent examiner and to have your record.

Example

Under cross-examination the examiner is asked how the court can know that the reconstructed image was not assembled to fit the case. The answer is the record: the cluster ranges, the rejected candidates and the reasons, the independent reproduction by a colleague to the same hash, the thumbnail comparison and the cloud copy, all documented before the report was written and all available to the defence's own examiner, who has been able to repeat the work. The examiner's confidence contributes nothing to that answer, and does not need to.

Before you move on

Image, tools, offsets, method and fragments all recorded well enough to reproduce.
Notes contemporaneous, custody unbroken, everything hashed, uncertainty stated.
Tools validated and material findings peer-reviewed from the record.
Record written on the assumption the other side's examiner will repeat it.

← 15. Analysis and correlation All chapters 17. Practice →

Back to the top of this chapter