The Arrest Was Real. But Was the Photograph?
Two AFP-released photographs, the same camera-class label, and very different forensic likelihood ratios. What SPOT found in the Kazem Hamad case.
Topic
Digital evidence
22 items from the laboratory.
AI-Generated CSAM: When Everything Is a Priority, Nothing Is
Detecting synthetic imagery is only part of the problem. The greater challenge is ensuring investigative resources reach the children who need protecting.
AI-Generated Images as Evidence: Authentication, Provenance and Forensic Examination
Forensic examination starts with the disputed proposition, the supplied file and the history of any transformations.
Synthetic-Media Forensics for Investigators: A Practical Framework
An evidential workflow for preserving questioned media, defining origin propositions and reporting uncertainty.
Explainer: how law enforcement decodes your photos
Richard Matthews’ 2017 explanation of image forensics, metadata and camera identification, republished from The Conversation.
Ghost protocol – Snapchat as a method of surveillance
A 2021 study of public Snap Map material as a source of open-source intelligence, including the limitations of relying on platform-supplied location information.
Reviewing a police digital-forensic report
A practical starting point for solicitors assessing the link between a technical finding and the inference advanced in a matter.
AIPIO 2026: forensic science in support of intelligence
AIPIO Intelligence 2026 sharpened a question for RHEM Labs: can forensic information about image origin reach analysts early enough to inform a decision?
When is independent digital-evidence review warranted?
Indicators that a focused forensic review may resolve a material uncertainty before a larger examination is commissioned.
ADSTAR 2026: from forensic research to useful capability
ADSTAR changed how RHEM Labs understands the path from a working forensic method to useful capability: mission need, problem ownership, experimentation and operational learning.
What to clarify before instructing a digital-forensic expert
Define the disputed inference, required opinion, available material and deadline before the examination begins.
A timestamp is not a person: digital traces and attribution
Why recording an event, identifying its cause and attributing it to a person are separate forensic questions.
Why a collection of digital traces is not yet a timeline
Ordering records by time is a presentation step; reconstructing events requires attention to meaning, clocks, coverage and uncertainty.
Windows artefacts: looking beneath the tool report
The source record, operating-system behaviour and decoding assumptions matter as much as a report’s label.
What metadata can and cannot establish
Metadata can inform origin, timing and file history, but its source and processing history must be understood.
Digital forensic expert or cybersecurity expert?
Choose expertise by the evidentiary question, the underlying systems and the reasoning required, rather than the job title.
Tool output is not expert interpretation
A software report can organise records; an expert must explain the reasoning that connects those records to the question.
Logical acquisition versus full acquisition: why completeness matters
Acquisition labels describe methods, not a guarantee that every relevant record has been preserved or decoded.
When should the underlying artefacts be examined?
Go beneath a derivative report when the source, processing or interpretation could materially change the answer.
What a digital forensic expert witness does
From a defined technical question to a reasoned opinion, with clear limits and an independent role in the proceeding.
Three RHEM Labs papers in the ANZFSS Melbourne 2025 supplement
The 2026 Australian Journal of Forensic Sciences supplement includes laboratory work on digital traces, synthetic media and 3D-printed firearm investigations.
Blueprints to firearms – a practitioner’s guide to investigating clandestine 3D-printed firearm labs
A practitioner-focused publication on the forensic investigation of clandestine 3D-printed firearm laboratories.