When should specialist support be requested?¶

Specialist support should be requested where the evidential question exceeds the available technical understanding, tools, authority or preservation capability.

Evidential caution: that asking for specialist help means the investigator has failed.

What this means¶

Specialist support may be needed for:

live-system capture;

memory analysis;

malware analysis;

complex cloud logs;

encrypted traffic;

database exploitation;

mobile or device extraction;

cryptocurrency tracing;

provider-specific interpretation;

large-scale timelines;

anti-forensics;

attribution;

recovery testing.

For example:

Did this process execute?

Was this file transferred?

Can this token explain the access?

Did the decryptor alter the evidence?

What does this provider field mean?

A vague request for “a forensic examination” may produce a large amount of data without answering the operational issue.

Specialist support may be needed before ordinary examination begins where live encryption, destructive malware, complex cloud environments or legal restrictions create risk. Early advice can prevent accidental evidence loss, unsafe execution or requests for records that the provider never retained.

The specialist should receive enough context to understand the investigative significance of the question. Provide the relevant timeline, identifiers, system role and competing explanations, but avoid directing them towards a preferred conclusion.

Request specialist support early for volatile, complex or platform-specific evidence, and frame the request around the precise investigative question that must be answered.

================================================================================

What to check or do next¶

• Investigators should define the question before requesting help.
• Preserve the original material, chain of handling, context and priority.
• Do not ask specialists to decide legal, investigative or organisational questions that depend on wider evidence.
• Record that context clearly. The operational takeaway is:

Evidential limits¶

It does not.