When should specialist support be requested?¶

Request specialist support when the evidential question exceeds the available technical understanding, tools, authority or safe preservation capability. Early advice is particularly important where delay or ordinary handling could destroy volatile evidence or create operational risk.

Using a specialist is a way to answer a defined question reliably, not a substitute for defining the investigation.

Recognise questions that need deeper capability¶

Specialist input may be appropriate for live-system or memory capture, malware analysis, complex cloud records, encrypted traffic, database compromise, device extraction, cryptocurrency tracing, anti-forensics, recovery testing or provider-specific interpretation.

Escalate early where live encryption, destructive code, unfamiliar production systems or legal and organisational constraints make a routine examination unsafe. Advice before collection can prevent accidental execution, lost keys, altered systems or requests for data a provider does not retain.

Give the specialist an answerable question¶

“Conduct a forensic examination” gives little direction. Questions such as “Did this process execute?”, “Can this token explain the access?” or “Did recovery tooling change these files?” identify the proposition and help select proportionate methods.

Provide the relevant timeline, identifiers, system role, preservation history, priority and credible alternative explanations. Preserve original material and handling records. Context should explain significance without steering the specialist towards a preferred result.

The specialist supplies technical findings and limitations. Wider legal, investigative and organisational conclusions still depend on the full body of evidence.