D3Forensics methodology

Detect. Document.
Demonstrate.

A documented process from lawful instruction to evidence a client, opposing expert or court can test. The method governs conduct as well as the final report.

Instruction and authority

Confirm the instructing party, the questions to be answered, the relevant jurisdictions and the lawful authority for each device, account and category of data. Agree the permitted scope and reporting purpose. Ownership, employment status or possession of credentials does not by itself authorise access to every record.

Preservation and custody

Record the item and its condition, protect the current state, document transfers and identify time-sensitive cloud or linked-device sources.

Acquisition strategy

Select the least intrusive proportionate method capable of answering the instructed questions, recording tool, version, settings and limitations.

Integrity and validation

Preserve original material, record cryptographic hashes where applicable, validate acquisition output and retain contemporaneous case notes.

Examination and correlation

Interpret underlying artefacts, correlate device, application, backup and counterpart evidence, and test alternative explanations.

Demonstration and reporting

Explain findings in plain English with referenced exhibits, disclose material limitations and separate fact, inference and opinion.

The governing discipline

Preserve first.
Interpret second.

Forensic work is not ordinary IT support or data recovery. Changes to a mobile device may be unavoidable, but they must be justified, minimised and documented. Tool output is a lead to be validated, not an expert conclusion in itself.

Reporting principles

Fact, inference
and opinion.

01State the materials examined and what was unavailable.

02Explain methodology so another competent examiner can test it.

03Distinguish direct artefacts from interpretation and attribution opinion.

04Report adverse findings and material limitations plainly.

05Use exhibits that trace each conclusion to its evidential source.

Frame the question before collecting more data

State the proposition to be tested: for example, whether a displayed message corresponds with available underlying records, rather than simply asking to “recover everything”.
Identify the disputed element: wording, timing, completeness, account association, human authorship or media provenance.
List the sources actually held and the sources believed to exist. Mark assumptions and unavailable items separately.
Record the relevant period, known device or account changes, and actions taken since the event.
State what result would support the proposition, what would challenge it and which alternatives need examination.
Agree the lawful scope, reporting purpose and decision points for any further work.

This worksheet structures an instruction. It is not a guarantee that the necessary data exists or that a technical examination can answer every disputed question. Do not enter credentials or confidential evidence into a public website form.

Confidential case review

Start with the question.

Instruct D3Forensics

Detect. Document.Demonstrate.