What should I ask the digital-forensics unit before relying on the report?¶

Ask them the smallest technical question that would change what you do next.

“Can you check the phone again?” is difficult to answer well.

“Does this outgoing WhatsApp entry come from the local app database, and is there any sign it was generated by a linked client?” gives the examiner something specific to test.

Take them the actual finding¶

Give the DFU:

• exhibit number;
• extraction/report version;
• application;
• relevant time;
• participant or account;
• artefact or source reference;
• what you think it means; and
• what part you are unsure about.

For example:

“In SA/12, WhatsApp message 18427 is shown as outgoing at 19:41 UTC. We need to know whether ‘outgoing’ means sent from this handset/account and whether linked-device activity could produce the same record.”

That is a useful forensic question.

Good reasons to go back¶

Ask the DFU when you need to understand:

• whether a relevant source was acquired at all;
• whether extraction was complete or partial;
• whether an app/database was successfully parsed;
• what a particular field or status actually means;
• whether deleted or recovered material is reliable enough for the decision;
• whether a timestamp needs source-level checking;
• whether linked-device or remote activity matters;
• why expected data is missing; or
• whether a second method or source examination is justified.

How do I find out what data was actually extracted? helps with the scope questions.

Do not ask the DFU to answer the whole attribution question¶

The forensic examiner can usually tell you what the source data and tool show.

They may not be able to tell you who physically held the phone at the relevant time, whether another person knew the passcode, or what CCTV and witness evidence says.

Keep those wider investigative questions with the investigation.

Missing data needs a precise question too¶

Instead of:

“There are no Signal messages. Is that right?”

try:

“Was Signal installed during the relevant period, was its data successfully acquired and parsed, and is all parsed Signal content included in this report?”

That separates absence from extraction or presentation limitations.

Make the answer reusable¶

Ask the examiner to identify the source field, path, artefact reference or limitation where that matters.

That means the answer can later be understood by another investigator, supervisor or court without relying on somebody remembering a telephone conversation.

The practical point is: go to the DFU with a defined technical dependency. The more precise the question, the more useful and reproducible the answer will be.