Phone:

Hidden from the page source until you click: friction against scrapers, not a guarantee.

Email:

[email protected]

Digital Forensics Guide

16. Confidence, reporting and defensibility

Credibility comes from reproducibility, not assertion. This chapter covers grading conclusions, what the report must contain, how derived material is presented, and what independent review requires.

In this chapter

  1. Evidential confidence and reporting
  2. Court defensibility and reproducibility

23. Documentation

Evidential confidence and reporting

A report must let the reader see how sure the examiner is of each finding, and why. The examiner grades every conclusion, states the grade, and lists the evidence that supports it and the evidence, if any, that cuts against it.

The confidence scale

  • Confirmed. Supported directly by intact forensic metadata, or by independently reproducible evidence: a file recovered from an intact record, a hash match against an independently existing copy, a reconstruction reproduced by a second method to the same hash and corroborated.
  • Strongly supported. Multiple independent artefacts support the conclusion and none contradicts it, but no single item proves it on its own: a reconstruction validated by structural decoding, thumbnail comparison and consistent timestamps, without an independent copy.
  • Probable. The reconstruction or inference is technically coherent and consistent with the evidence, but relies in part on examiner judgement or on assumptions that could not be tested: a fragment order chosen on content continuity alone, or an interpretation that depends on the system clock being correct when no reference was recorded.
  • Possible. The evidence is consistent with the conclusion but insufficient for a stronger grade, or alternative explanations remain open: a carved fragment that may belong to the file in question, an encrypted partition whose contents are unknown.

A conclusion is never graded higher than the weakest evidence it depends on. A timeline entry derived from a "probable" reconstruction is at most probable, whatever else surrounds it. Where a conclusion could be raised by evidence that was not available, say what that evidence would be.

Reporting derived material

  • Never present inferred or manually reconstructed material as equivalent to an untouched original. Label it, in the text and in any exhibit list, as reconstructed, with its confidence grade and a reference to the reconstruction record.
  • Present recovered fragments as separate exhibits alongside the reconstructed file, so that the reader can see what the examiner started from, and another examiner can reproduce the process.
  • Report negative results and failed attempts with the same care as successes: the volume that was not decrypted, the candidate fragment that was rejected, the tool that produced an error. Omitting them is what turns an honest limitation into an apparent concealment under cross-examination.
  • Report limitations explicitly: unreadable sector ranges, the memory capture footprint, tools that disagreed, assumptions that could not be tested.
  • Keep the label on each statement (see the introduction): observed fact, tool-reported information, interpretation, inference or hypothesis, recovered evidence, derived artefact, conclusion with grade.

What the report must let another examiner understand

The final report is read by people who were not there and by an examiner who may repeat the work. It must state, in a form each of them can follow:

  • What evidence was received: every item, with its reference, description and hash.
  • Its condition on receipt: powered state, seals, damage, encryption, prior handling.
  • What actions were taken, in order, with times.
  • Why those actions were taken, particularly for every live interaction and every departure from the standard order.
  • What tools were used, with versions, configuration and, for anything run on a live system, the executable hash.
  • How integrity was verified: hashes at acquisition, verification results, re-verification before analysis.
  • What was recovered, and from where.
  • What was reconstructed, by what method, with reference to the reconstruction records.
  • What could not be recovered: encrypted volumes not opened, unread sectors, carving that produced nothing usable, attempts that failed.
  • What limitations applied: to the acquisition, to the tools, to the examiner's time and scope.
  • Which conclusions are factual, resting on observed facts and intact metadata.
  • Which conclusions involve interpretation or inference, and the confidence assigned to each.

Where evidence is incomplete, corrupted, encrypted, reconstructed or otherwise uncertain, the report says so in the finding it affects, not in a general caveat at the end.

Structure of a finding

Each material finding in the report should be able to stand as a unit: the question it answers; the conclusion and its grade; the observed facts with their locations in the image; the interpretation of those facts and the basis for it; the derived artefacts involved and where their reconstruction records are; the corroborating and contradicting evidence; and the limitations. A reader who accepts the facts, follows the interpretation and checks the records should arrive at the same grade.

Example. "Finding 4. A JPEG image (exhibit D-12, SHA-256 H1) depicting the subject matter was present on the data volume. Confidence: confirmed. Basis: the image was reconstructed from clusters 118,204 to 118,215 and 118,301 to 118,309 of the decrypted data volume (record R-7); the reconstruction was reproduced independently to the same hash (record R-8); a file with hash H1 exists in the cloud export (exhibit C-3). Limitations: no filesystem record for the file survives, so its original name and path are not known; the EXIF timestamp of 19:15 is consistent with the removable media activity in finding 3 but has not been independently verified."

24. Documentation

Court defensibility and reproducibility

Forensic credibility does not come from the examiner's certainty, qualifications or manner. It comes from another competent examiner being able to take the same materials, follow the same record, and arrive at the same result. Everything in this guide serves that test.

What independent review requires

For every material finding, the examination record must allow a second examiner to reproduce the work using:

  • The same forensic image, identified by its hash, together with the memory capture, the ddrescue map and any decrypted volume, each with its hash and the record of how it was produced.
  • The recorded tools and versions, with executable hashes where they were recorded, and the configuration or command line used at each step.
  • The same source offsets or clusters: every location in the image that a finding depends on, stated precisely enough to be opened in a hex viewer.
  • The documented reconstruction method, including manual decisions and their reasons, so that the second examiner can make the same decisions or see where they would have decided differently.
  • The original fragments and derived artefacts, retained as exhibits with hashes, so that the assembly can be repeated and the result compared.

The pillars

  • Contemporaneous notes. Written at the time, in sequence, never rewritten, with corrections as dated additions. They are the primary record; the report is a summary of them. Expect to produce them.
  • Chain of custody. Unbroken from seizure to court for every physical item and every digital exhibit (section 10).
  • Cryptographic hashes. For the original, the master, each working copy, each derived artefact, each fragment and each tool. A hash recorded at the time is the only proof that what is presented is what was acquired.
  • Transparent reporting of uncertainty. Every limitation, every failed attempt, every assumption and every grade below confirmed, stated in the report rather than discovered in cross-examination.

Practical guidance

  • Write the record as you go, as if the second examiner were reading over your shoulder. If a step cannot be written down clearly enough to repeat, it is not finished.
  • Have material findings peer-reviewed before the report is issued, by an examiner who works from the record rather than from a conversation with you. Their inability to reproduce a result is a defect in the record, to be fixed before it is relied on.
  • Validate tools before relying on them: know what a tool does with corrupt input, whether it modifies what it mounts, and where its documented limitations are. Keep validation records.
  • In England and Wales, an expert witness owes a duty to the court that overrides any obligation to the instructing party, and must state the facts and assumptions a conclusion rests on and anything that might undermine it. The disciplines in this guide are how that duty is discharged in practice.
  • Expect the other side to have a competent examiner and to have your record. Write it for them.

Example. Under cross-examination the examiner is asked how the court can know that the reconstructed image was not assembled to fit the case. The answer is the record: the cluster ranges, the rejected candidates and the reasons, the independent reproduction by a colleague to the same hash, the thumbnail comparison and the cloud copy, all documented before the report was written and all available to the defence's own examiner, who has been able to repeat the work. The examiner's confidence contributes nothing to that answer, and does not need to.