Digital Forensics
Examine the record behind the record.
Assess document properties, chronology and apparent inconsistencies in the context of the available source material.
01
Start with the best available source.
Identify whether the material is an original file, export, copy, image or screenshot. Each has a different relationship to the underlying record and may preserve different information.
02
Examine the apparent inconsistency.
Clarify which property, date or version is in dispute. Compare relevant records where available and consider how ordinary system or copying activity could affect the interpretation.
03
State the conclusion carefully.
An examination can support or challenge a proposition without establishing everything about a record. Explain what was tested, the sources used and any missing context that prevents a stronger conclusion.
RELEVANT SOURCES
Start with what is available.
Discuss the sources that can help answer the question, within an authorized scope.
Original and available comparison filesBEFORE WE BEGIN
A more useful first conversation.
- Provide the questioned record and its origin.
- Identify the specific concern.
- Preserve original copies and relevant comparison material.
RELATED ARTICLES
Useful before you need us.
Practical perspectives and clear next steps.
YOUR NEXT STEP
What do you need to understand?
Tell us what you need to understand.