What was actually acquired?
A report can only describe the material available to its examination. A logical export, a filesystem acquisition and a physical acquisition can have different coverage. Labels such as “full” should be tested against the device, method, logs and actual contents, rather than treated as a guarantee of completeness.
RHEM Labs examines acquisition and integrity questions: what was preserved, which data was accessible, what may be absent, and how processing produced the material now relied upon. Practical acquisition work is assessed for the specific device and available method; access or recovery cannot be guaranteed.
Integrity and interpretation
Hashes can help establish that particular bytes have remained unchanged. They do not independently establish the history, completeness or meaning of those bytes. Chain-of-custody records, acquisition logs and documented transformations need to be considered together.
Useful material after engagement
The original acquisition or agreed forensic copy, acquisition logs, hash records, tool and version details, export settings and relevant handling records may be needed. Discuss the question first; substantive material is transferred securely after conflict checking and engagement arrangements.