This checklist is a practical aid for legal practitioners and professional organisations. Adapt it to the matter and the applicable instructions. It is not a completed instruction or a finding about any evidence.
Source and acquisition
- What exact artefact, file, database record or acquisition supports this finding?
- What was acquired, what was inaccessible and what limitations were recorded?
- How is the supplied report linked to the source material and its identifiers?
- What do the integrity checks establish, and what do they not establish about completeness?
Processing and meaning
- Which tools, versions and settings produced this output?
- Were filters, time conversions, decoding rules or joins applied?
- What does the displayed label mean in this system and context?
- Could the same observation arise from background activity, synchronisation or another technically reasonable cause?
Inference and further work
- What links a device or account record to a particular person or state of knowledge?
- Which assumptions and alternative explanations affect the opinion?
- Would examining the underlying artefacts resolve a material uncertainty?
- What further material or testing would be useful, and which conclusions remain limited without it?
Further guidance
Read How to instruct a digital forensic expert, Fees & engagement and the forensic questions hub. Contact the laboratory with a concise, non-sensitive enquiry.