Preservation & chain of custody
- Evidence is acquired with forensically sound methods, using hardware or software write protection where the media allow it.
- Acquisitions are verified with cryptographic hash values, recorded at acquisition and re-checked before analysis and reporting.
- Analysis is performed on verified copies, never on the original evidence.
- Every transfer of evidence is documented in a chain-of-custody record.
Tools & validation
- We use established forensic tools and record the tool and version used for each step.
- Artifacts that matter to an opinion are verified independently: by a second tool, by manual examination of the underlying data, or both.
- Where a tool's parsing of a data source is uncertain or untested, we test it against known data before relying on it.
Analysis & documentation
- Contemporaneous notes record what was examined, how, and what was found, in enough detail for the work to be reproduced.
- Alternative explanations are considered and tested, not just the hypothesis we were asked about.
- Timestamps are interpreted with attention to time zones, device clocks and how each source records time.
Reporting
- Reports set out the materials examined, the methods used, the findings and the basis for each opinion.
- Every report states the limitations of the analysis: what the evidence can and cannot establish, and any known error rates or sources of uncertainty.
- Opinions follow the evidence. Findings are reported whether or not they help the party that retained us.
Standards & guidance
Our practices are informed by published guidance in the field, including NIST Special Publication 800-86 (Guide to Integrating Forensic Techniques into Incident Response), the best-practice documents of the Scientific Working Group on Digital Evidence (SWGDE), and ISO/IEC 27037 (guidelines for identifying, collecting, acquiring and preserving digital evidence).
These methods are also designed to meet the reliability factors courts consider when admitting expert testimony, such as Federal Rule of Evidence 702 and its state equivalents: testable methods, known error rates, peer-reviewed techniques and general acceptance in the field.