Focused second opinion
Independent Review of Digital Forensic Reports and Extracts
A focused second opinion on whether a digital forensic report, police extraction, Streamlined Forensic Report or opposing analysis is supported by the underlying material, method and stated limitations.
Independent review without a predetermined answer · Direct access to Alistair Ewing · No evidence through the public enquiry
A proportionate second opinion
Test the reasoning as well as the result
An independent review is not an assumption that the earlier work is wrong. The answer may be that it is sound, that clarification is needed, that a limited check would resolve the issue or that further examination is justified.
The initial scope connects the disputed proposition to the report, available source material and deadline. It avoids repeating acquisition or analysis that will not add useful evidence.
Questions a review may address
- Was the correct material examined and was its acquisition sufficiently documented?
- Do reported totals, selections and timestamps agree with the available source?
- Are deleted records, generated data and background activity interpreted in context?
- Does a conclusion go beyond what the artefacts support?
- Are reasonable alternatives or tool limitations missing?
- Would fresh examination be proportionate, or is the existing work sound?
Material commonly considered
- The report, Streamlined Forensic Report, schedule or technical statement in issue.
- Extraction indexes, audit logs, acquisition notes, exhibit references and hashes.
- The underlying extraction, forensic image or native file where needed and available.
- The letter of instruction, relevant pleadings, agreed facts and date range.
- Any response, clarification or account of the earlier method.
Choose the useful output
Review depth matched to the evidence question
Feasibility note or conference
A concise first stage to identify whether the point is technically reviewable and what source material would be needed.
Advisory review or questions
A documented assessment of the existing work, including focused clarification questions and proportionate next steps.
Formal expert report
Independent opinion where justified, properly instructed and supported by sufficient material, with limitations made explicit.
How the review is approached
Source, method, interpretation and limits
- Define the proposition. Identify the finding or omission said to matter.
- Map the material. Record what was supplied, what source it represents and what is unavailable.
- Reconcile the account. Compare the report, logs, totals, timestamps and source artefacts proportionately.
- Test alternatives. Consider software behaviour, acquisition limits and other technically reasonable explanations.
- State the answer. Separate supported findings, qualifications, unresolved points and recommended further work.
What to send for an estimate
- Party and entity names for conflict checking.
- The exact report, extract or conclusion to be reviewed, described without uploading it.
- The question the review needs to answer and the relevant date range.
- What underlying material is available and its approximate size.
- Report, conference or hearing deadlines and the funding route.
Review boundaries
- A difference of opinion does not itself demonstrate that earlier work is unreliable.
- A report may be assessable only in part if source material or method records are missing.
- No favourable criticism or litigation outcome is promised.
- Police handset material retains its focused review route where that is the principal issue.
Do not send the report, extraction or evidence through the public form.
Start with the disputed finding
Scope an independent digital forensic review
Provide party names, the conclusion or omission in issue, the material available and the deadline. Evidence follows only through an agreed route.