When should I return to the digital-forensics unit or specialist?¶

Go back when the answer you need depends on something below the level the reader can reliably show you.

Most routine findings do not need bespoke forensic validation. If you can see a normal active message, photograph, call or contact and you only need it as the next line of enquiry, the reader may be perfectly adequate.

Return to the specialist when the technical detail could materially change the decision.

Good reasons to escalate¶

Examples include:

• an acquisition was partial or failed;
• important app data was encrypted or unsupported;
• a decisive artefact is recovered, deleted or fragmented;
• message direction or status is ambiguous;
• a timestamp is disputed and minutes matter;
• linked-device or remote activity could change attribution;
• an important result appears in only one parser;
• expected data is missing and the absence matters;
• source provenance is unclear; or
• a high-consequence decision depends on one technical interpretation.

Match the effort to the consequence¶

Suppose a reader shows an ordinary active WhatsApp message.

If you are using it to identify another participant for enquiry, you may not need anything more.

If that single message is going to drive an arrest, disciplinary decision or expert conclusion and its direction or authorship is disputed, deeper validation may be entirely reasonable.

That is the practical proportionality test.

Take a defined question back¶

Do not ask:

“Can you check everything?”

Give the specialist:

• exhibit and report;
• exact artefact;
• source path or reference where available;
• the technical question;
• the alternative explanation you are concerned about; and
• the decision that depends on the answer.

For example:

“This recovered message is shown as outgoing at 18:12 UTC. The suspect says it came from a linked desktop. Can you establish from the source data whether the artefact identifies the originating client?”

That gives the examiner a bounded job.

What should I ask the digital-forensics unit? helps frame that question, while what corroboration should I look for? helps with the wider investigative evidence around it.

Do not outsource ordinary investigation¶

The DFU can answer technical questions about the extraction.

They cannot replace CCTV, witnesses, provider records, account history or other evidence that may be needed to show who actually controlled the device or account.

The practical point is: return to the specialist when a technical dependency genuinely matters. Take them the exact artefact and exact question, not the whole investigation.