TRUST-IT Content reviewed
DECISION BRIEF
What you will be able to decide
For: Business owners, legal advisers and incident coordinators commissioning a digital investigation.
Decide what to preserve, what can be established and which deliverables to request.
- Write a testable question and identify the authorised case owner.
- Separate source integrity from the interpretation of events.
- Require a referenced timeline, coverage limits and a clear next decision.
Write the question before choosing a tool
“Find out what happened” needs to become a set of testable questions. Was a particular document accessed? Did an account send an instruction? What activity preceded an outage? State the relevant people, systems and period, and identify the decision the answer will support. This keeps collection proportionate and gives the investigator a basis for explaining what additional work would achieve.
Separate preservation, collection and analysis
Preservation aims to keep relevant material available. Collection produces the evidence set that will be examined. Analysis interprets that material in relation to the question. These are connected activities with different decisions and records. Ask what will be collected, why that method is suitable, what changes it may cause and how the source will remain traceable. A screenshot may be useful, but it rarely captures every relevant property of the original record.
Related primary guidance: NIST SP 800-86
Agree authority, recipients and handling
Before access, identify the person or entity entitled to authorise it and any instructions from legal or privacy advisers. Define reporting recipients, a secure exchange process and the treatment of unrelated sensitive material. Mixed personal and company information needs explicit boundaries. A case register should connect each item to its source, collection context and subsequent handling, so another reviewer can follow its history.
Expect correlation and alternative explanations
A timestamp, IP address or username rarely tells the whole story. Automated tasks, shared accounts, time-zone differences and incomplete logs can change the interpretation. A sound report explains how multiple sources support the chronology and examines plausible alternatives. It also distinguishes account activity from attribution to a person, and observed access from a claim about intent or onward disclosure.
From source material to a defensible finding
Preserve the original record and its handling history while making each interpretation traceable.
- QuestionScope, authority and decision
- PreservationSources, expiry and access
- CollectionNative records and integrity
- CorrelationTime, identity and alternatives
- FindingReferences, limits and next step
A hash supports an integrity check from the point it was recorded. It does not prove that an original statement is true or identify its author.
Read the limitations as part of the result
Ask which sources were unavailable, which periods lack coverage and which methods could not be applied. Deleted data may not be recoverable, and an encrypted or damaged device may limit examination. NIST’s digital evidence overview describes the importance of reliable collection and the challenges posed by varied sources. A report that clearly states an unanswered question can be more useful than an unsupported definitive conclusion.
Commission outputs you can actually use
Agree an executive explanation, referenced findings, a timeline, relevant exhibits and a technical methods section appropriate to the matter. Ask how supporting material will be delivered and retained. If the investigation informs a legal dispute, counsel should direct the procedural requirements. If it informs recovery, connect recommendations to owners and verification steps. The value lies in the decisions the evidence can support.
Choose evidence sources for the question
An investigation should begin with a source map, not an indiscriminate copy of everything. Record who controls each source, the relevant period, available retention, access authority and the decision it may support. Time-sensitive preservation may run alongside scope discussions, under the direction of the authorised case owner. Collection should not erase the distinction between personal, company and third-party information.
A cryptographic hash helps demonstrate that a collected file has not changed since that hash was recorded. It does not establish that the original content was truthful, who created it, or whether the collection is complete. Preserve export parameters, tool versions, errors, time-zone settings and collection logs alongside the data.
On a small screen, scroll the table sideways to compare all columns.
| Source | What it can help establish | Important limitation |
|---|---|---|
| Email and cloud audit | Message routing, mailbox changes, file activity and application access. | Available events depend on service configuration, licensing, permissions and retention. |
| Computers and mobile devices | Local files, browser artefacts, applications and device activity. | Encryption, device state, deletion and collection method affect what can be recovered. |
| Identity and network records | Sign-ins, administrative changes and connections between systems. | An IP address or shared account does not establish the identity or intent of a person. |
| Public sources and blockchain | Published claims, transaction paths and externally observable relationships. | A transaction or public label alone does not prove beneficial ownership. |
From a concern to a reviewable finding
- Define
State testable questions, sources, authority and reporting recipients.
- Preserve
Identify expiry risks and document preservation decisions.
- Collect
Record methods, identifiers, integrity checks and handling.
- Correlate
Compare sources, time references and alternative explanations.
- Report
Connect conclusions to exhibits, uncertainty and next decisions.
Specify deliverables and decision points
A useful engagement can produce a collection register, a source-coverage matrix, a normalised timeline and findings that cite individual evidence items. The executive account should distinguish established facts, supported interpretations and unresolved questions. Technical appendices can explain tools, queries, transformations and reproducibility without exposing unrelated private material to every recipient.
Agree an initial triage checkpoint before promising a final completion date. Urgency, numbers and types of sources, access approvals, export delays, encryption, data volume, language and specialist review all influence effort. A narrowly scoped mailbox question differs materially from a multi-entity investigation involving mobile devices, cloud services and litigation support. Additional sources or newly discovered questions should trigger an explicit scope and cost decision.
Agree who can receive each deliverable, how working copies are protected, and when material will be returned, retained or deleted subject to applicable instructions. Where the matter may support proceedings, the responsible legal advisers determine procedural requirements. Technical findings can support that work; an investigation cannot promise a legal outcome.
WORKED EXAMPLE
A disputed change of payment instructions
Illustrative scenario, not a client case. A finance team receives new bank details apparently sent by an established supplier. The supplier disputes the message. The investigation asks which account and message path were involved, and whether available records establish an authorised instruction.
- Evidence and checks
- The authorised examiner preserves the native messages, relevant mailbox and identity audit exports, the approved supplier-contact record and the payment-approval trail. Each export has a source identifier, period, collection log and integrity record. Message identifiers and timestamps are correlated; forwarding, delegated access and missing event coverage are considered.
- Supported conclusion and next action
- The reviewed sources may support a mailbox or message chronology without identifying the person controlling the account. The report separates the recorded instruction, the internal approval decision and the unresolved attribution. Finance and legal advisers use that distinction to determine the next action.
What to request from your provider
Use these criteria to compare the proposed work and review the result. The scope and acceptance checks should be agreed before delivery.
Swipe across the table to see all columns.
| Deliverable | What it includes | Acceptance check |
|---|---|---|
| Evidence register | Stable item IDs, source, collector and handling history. | Every exhibit resolves to its source record. |
| Coverage matrix | Available periods, missing sources and export limitations. | The report does not imply coverage outside the collected set. |
| Timeline | Original times, normalised times and correlation rationale. | A reviewer can reproduce the ordering and see uncertainty. |
| Findings and review | Facts, interpretations, alternative explanations and next decisions. | Each material conclusion cites evidence and states its limits. |
TAKE THIS INTO YOUR NEXT MEETING
Your preparation checklist
- Name the authorised owner, question and reporting recipients.
- List relevant systems, accounts, dates and source owners.
- Identify expiring records and agree preservation priorities.
- Record collection parameters, time zones and integrity checks.
- Require facts, inferences and unresolved questions to be separated.
- Agree a review checkpoint, scope changes and evidence handling after closure.
Use the bilingual workbook for notes or the editable CSV to assign owners and evidence references. These are preparation templates, not a completed assessment.
Further reading
Put the guidance to work
Forensic examination of computers, phones, storage media and backups, with documented acquisition, timelines and evidence limitations.
Computer & mobile forensics