Why Question Framing Determines Report Value
A forensic examination is not a search for anything and everything that might be relevant. It is a systematic investigation of a defined set of questions using a defined set of evidence sources. The examiner follows where the evidence leads — but only within the scope you define.
An instruction to "examine the phone and tell me what you find" will produce an enormous report documenting hundreds of artifacts with no connection to your case theory. An instruction to "determine whether the defendant communicated with the alleged co-conspirator between January and March, and whether any documents were transferred" produces a report you can actually use.
Characteristics of a Well-Formed Investigative Question
- It is specific. It names a particular action, communication, file, or time period rather than a general category.
- It is testable. It can be answered yes, no, or inconclusive based on what the evidence shows.
- It is tied to a legal issue. It addresses something that matters to your theory of the case, a defense, or a factual dispute the court will need to resolve.
- It does not presuppose the answer. "Prove that the defendant deleted the files" is not an investigative question. "Determine whether files in the specified directory were deleted, and if so, when" is.
Common Question Categories
Activity and access questions: Did a specific user access a specific file, folder, or application? During what time period? From which device or account?
Communication questions: Were communications sent or received between specific parties? What was the content? Were they authentic or altered?
Transfer questions: Was data copied, moved, or transmitted to an external device, account, or recipient? When? How much?
Deletion and destruction questions: Were files deleted? When? By what method? Is recovery possible?
Authentication questions: Was this image, document, or recording genuine, altered, or fabricated?
What Happens When Questions Are Poorly Defined
Vague scope leads to one of two problems: an examiner who examines too broadly and produces an unusable data dump, or an examiner who makes assumptions about what you meant and examines the wrong things. Both outcomes cost more than a well-scoped engagement and produce less useful results.
It is worth spending time before the initial consultation writing out your investigative questions in specific terms. That conversation will go faster, the scope will be tighter, and the report will be more directly useful to your matter.