Acquisition
Device, state, authority, tool, version, extraction type and recorded errors.
Independent technical review
Test the extraction.
Test the conclusion.
Review of police, opposing-expert and third-party mobile forensic material for scope, methodology, completeness, interpretation and unsupported inference.
Review scope
From acquisition
to asserted finding.
A review should follow the analytical chain, not merely compare report wording.
Completeness
Whether the supplied extraction contains the applications, dates, attachments and context relied upon.
Interpretation
Validation of timestamps, identifiers, status flags, deletion labels and tool-generated categories.
Attribution
Whether device ownership, account control and human authorship have been improperly conflated.
Exhibits
Whether screenshots and schedules trace accurately to source artefacts and preserve surrounding context.
Opinion boundary
Whether the conclusion is supported, qualified and within the examiner’s expertise.
Language, transcription and translation
Preserve the original message or audio alongside any transcription or translation. Record who produced the translation, the language or dialect considered, and material ambiguity. Names, abbreviations, emojis, slang and code-switching can change the meaning of an isolated phrase.
Automated transcription or translation can assist review, but should not be treated as a verified rendering of a disputed passage. Where linguistic meaning is material, agree suitable independent language expertise and retain the connection between the translated passage and its original source. Technical extraction alone does not resolve meaning or speaker identity.
Minimum review package
Request the original acquisition or compatible backup/file-system image, hashes, custody record, acquisition logs, tool/version details, extraction errors and the complete report with schedules. Reader packages such as UFDR and compatible third-party device images can be assessed, but may be processed subsets rather than the original source.
Review stages
- Confirm independence, conflicts, authority and issues in dispute.
- Inventory and verify supplied material, hashes and missing sources.
- Compare material findings with underlying records and independent corroboration.
- Test alternative explanations and document unresolved gaps.
- Provide an issues schedule, source-linked findings and a proportionate report.
Independence and limits
A named lead is accountable. Any specialist assistance or independent checking should be agreed and recorded; no universal peer-review scheme is claimed. Conclusions are independent of the payer, limited to expertise and revised when new evidence warrants it. Adverse findings and material limitations must be disclosed. A review cannot guarantee admissibility or recover data that was never supplied.
Discuss a review instructionConfidential case review
