Start with the evidentiary problem
These questions connect an issue to an explanation and a proportionate next step. The scenarios are hypothetical, not case histories or claims of outcomes. You do not need to know a service name before asking about the evidence.
Does a timestamp identify a person?
A time value needs its generating mechanism, clock context and corroborating evidence before it can support human attribution.
Illustrative scenario. A report attributes user activity mainly from file times. Separate the recorded event from intentional action and identify what connects it to the person.
Read the explanation · Relevant technical capability · Appropriate engagement.
Does a phone extraction contain all relevant data?
An extraction has a defined coverage; a rendered report may show only part of it.
Illustrative scenario. A logical phone extraction contains no relevant application entry. Establish whether that application and its underlying data were acquired before treating absence as a finding.
Read the explanation · Relevant technical capability · Appropriate engagement.
What does a logical acquisition omit?
The answer depends on the device, method, accessible sources and state at acquisition. “Full” is not a completeness guarantee.
Illustrative scenario. The question turns on data outside an export. Identify the required source and whether it can be obtained without compromising preservation.
Read the explanation · Relevant technical capability · Appropriate engagement.
Can metadata establish authorship?
Metadata may describe a file or processing history without reliably identifying who created the intellectual content.
Illustrative scenario. An author field names an account holder. Examine how that field was set, inherited or modified and what independent material supports attribution.
Read the explanation · Relevant technical capability · Appropriate engagement.
Does a tool report prove the conclusion being advanced?
A decoded observation and the interpretation placed on it are separate parts of the reasoning.
Illustrative scenario. A report presents a confident conclusion but does not explain the underlying artefact. Trace the output to its source and test the inference.
Read the explanation · Relevant technical capability · Appropriate engagement.
When should underlying artefacts be examined?
Go deeper where source context, decoding or acquisition coverage could materially change the answer.
Illustrative scenario. Two exports disagree. Determine whether they use the same material and interpretation before treating the disagreement as a conflict in the evidence.
Read the explanation · Relevant technical capability · Appropriate engagement.
Was the evidence acquired completely and reliably?
Integrity of a defined copy and completeness of acquisition answer different questions.
Illustrative scenario. An acquisition has matching checksums but its coverage is disputed. Review the method, logs, exclusions and relationship to the supplied report.
Read the explanation · Relevant technical capability · Appropriate engagement.
Can a digital image’s origin be assessed?
Image-origin questions require appropriate source material, defined hypotheses and an account of the method’s limits.
Illustrative scenario. A photograph is alleged to have a different origin from that claimed. Preserve the original file and processing history, then identify which aspect of provenance is disputed.
Read the explanation · Relevant technical capability · Appropriate engagement.
What can synthetic-media analysis establish?
Origin consistency is a narrower question than the truth of the scene depicted.
Illustrative scenario. An image is alleged to be synthetic or manipulated. Distinguish whole-image origin, partial editing and a camera photograph of a synthetic display.
Read the explanation · Relevant technical capability · Appropriate engagement.
How should conflicting digital traces be interpreted?
Records may describe different events or use different clocks and update rules. Sorting them does not establish a causal timeline.
Illustrative scenario. New material appears after an expert report. Identify what it changes, which assumptions are affected and whether supplementary work is needed.
Read the explanation · Relevant technical capability · Appropriate engagement.
When is independent review warranted?
A focused review is useful when a material inference or technical uncertainty may affect the decision.
Illustrative scenario. A legal team needs to decide whether further examination is justified before commissioning a substantial scope. Identify the issue and the smallest useful next enquiry.
Read the explanation · Relevant technical capability · Appropriate engagement.
Moving from the question to an instruction
Every question above should be considered against the expert’s relevant knowledge and the material available. Read Dr Matthews’ profile and CV, use the instruction guide and checklists, and review Fees & engagement.
Contact the laboratory with your professional role, the broad question and the deadline. Do not send substantive material until conflict checking and engagement arrangements are complete.