FORENSIC SCIENCE · INDEPENDENT EXPERT EVIDENCEAdelaide, Australia
RHEM LabsInstruct an expert

Practitioner resources

How to instruct a digital forensic expert

A practical guide for legal practitioners and professional organisations, from the first question to secure transfer and a scoped opinion.

Frame the evidentiary question

Describe the proposition that matters and the material said to support it. Separate the observed record from the inference about a person. “Does this timestamp establish that the account holder opened the file?” gives the expert a starting point; “prove the report wrong” does not.

Identify the decision the work must inform, the relevant period, alternative explanations already raised and any assumptions that should be tested. A technical conference can help refine an uncertain question. The forensic questions hub offers examples.

Identify the available material

At first contact, describe categories and approximate volume. Useful material may include an existing expert report and appendices, extraction or acquisition logs, native exports, device or filesystem images, source databases and their associated files, relevant correspondence about technical questions, and any instructions governing the examination.

Identify the report author, report version, tool and version if known, exhibit identifiers and whether the underlying acquisition is available. State restrictions on access, custody or copying. Do not send that material through the public enquiry form; the first message should be a brief, non-sensitive description.

Give each deadline a purpose

Distinguish the report deadline, disclosure date, conference and hearing dates. Say when the material can actually be supplied. Access problems and missing source records can affect what is possible within the available time. Availability must be confirmed; entering a date on the form does not reserve it.

Conflict checking and engagement

The laboratory will arrange the information needed for conflict checking directly. Be ready to identify the relevant parties, organisations and professional representatives through the agreed channel. Avoid substantive briefing until the conflict check and engagement arrangements are complete.

Agree the questions, deliverable, scope, cost and timing. Provide any applicable court directions, expert code or procedural requirements with the formal instruction. The instructing practitioner should identify the requirements that apply to the particular jurisdiction and proceeding.

Secure transfer after engagement

RHEM Labs provides matter-specific secure transfer arrangements through its business infrastructure. The website is not an evidence-upload service. Agree the inventory, file formats, identifiers, access restrictions and handling requirements before transferring material.

Preserve original exports and acquisition records. Do not convert a native database into screenshots or repackage material simply to make it easier to email. Where checksums are available, include the algorithm and the exact object they describe. A matching checksum helps establish consistency of copies; it does not establish that the original acquisition was complete.

Use the Material Transfer Checklist once arrangements are agreed. Do not send passwords, restricted material or classified information through the public form.

What happens after first contact?

  1. Enquiry and conflict checkEstablish who is instructing and whether the laboratory can consider the matter.
  2. Question, scope and engagementConfirm expertise, availability, deliverables and cost.
  3. Secure transfer and examinationCheck the inventory, examine the relevant records and resolve material gaps.
  4. Opinion and further assistanceExplain findings and limitations; scope conferences, supplementary work or oral evidence if needed.

An examination may identify a need for further material or narrow the question. An opinion can support, qualify or contradict a proposed inference. Independence includes reporting limits and technically reasonable alternatives.

Prepare an instruction

Read Dr Matthews’ expertise and CV and the available engagement types, then contact the laboratory. Direct litigation briefs are accepted through legal practitioners, not self-represented parties.

FORENSIC INSTRUCTIONS

A question about digital evidence?

For legal practitioners and professional organisations: discuss the forensic question, available material and timeframes.

Contact the laboratory