The framework below tracks the ISO/IEC 27037 phases of identification, collection, acquisition and preservation, and the ACPO Good Practice Guide expectations that examiner activity be documented, reproducible and independently reviewable. It is the sequence a competent laboratory will follow whether the matter is a family-court dispute over a single phone or a multi-custodian internal investigation running to terabytes.
The six stages
- 01Instruction and scoping. Framing the questions the report must answer, agreeing the sources in scope, and setting the procedural standard — CPR Part 35, Criminal Procedure Rules Part 19, or an internal investigation report.
- 02Identification. Enumerating devices, accounts, cloud tenants and services that may hold relevant material, and identifying custodians. Often the most productive stage for cost control.
- 03Preservation. Sealed, hashed, contemporaneously documented copies of every source in scope. Nothing is analysed until preservation is complete and verified.
- 04Analysis. Interrogation of the working copies against the pleaded issues — timeline reconstruction, keyword and semantic search, artefact-level examination, and testing of alternative hypotheses.
- 05Reporting. A written report to the applicable standard: methodology, findings, limitations, and the examiner's declaration of duties to the court.
- 06Testimony. Attendance at trial or hearing where the report is challenged, with the working papers and the underlying images available for the tribunal.
What each stage produces
| Stage | Deliverable | Who signs it off |
|---|---|---|
| Scoping | Written engagement letter with issues, sources, standard, deadline and fee estimate. | Instructing solicitor and examiner. |
| Identification | Custodian and source map, retention position for each, preservation plan. | Examiner, reviewed by counsel where privileged. |
| Preservation | Acquisition log, hash values, chain-of-custody records, sealed evidence bags. | Examiner and case manager. |
| Analysis | Working papers, timeline, keyword-hit review notes, exhibit list. | Examiner and peer reviewer. |
| Reporting | Signed Part 35 (or equivalent) report with appendices. | Examiner, with peer review. |
| Testimony | Attendance, cross-examination notes, any supplemental report. | Examiner. |
Where the cost really sits
Analysis, not extraction. Acquisition of a smartphone or laptop is a defined piece of work with a defined price. Analysis expands to fit the instruction it is given. A tightly scoped instruction — three named custodians, four issues, a date range of six weeks — will always produce a shorter, sharper and more defensible report than a general instruction to 'examine the devices'. The single most valuable half-hour in a forensic engagement is the scoping call, and it is routinely the one clients try to skip.
A good scoping conversation halves the analysis budget and doubles the value of the report. Skipping it is the false economy that every experienced litigator has learned once.
Common scoping mistakes
- Instructing on the device rather than on the question — 'examine the phone' rather than 'establish whether X communicated with Y on these dates'.
- Omitting the date range, forcing the examiner to review years of material to be safe.
- Failing to identify the cloud accounts and secondary devices where the relevant conversation may actually live.
- Waiting to instruct until after disclosure obligations bite, compressing the analysis window and inflating the cost.
- Not agreeing at scoping whether a preliminary opinion is needed before the full report — the two products are priced very differently.
What we ask instructing solicitors to send
- The pleaded (or anticipated) issues, in the form a tribunal would recognise.
- A list of custodians, devices, accounts and cloud tenants believed to be in scope.
- The relevant date range, and any known events fixing its outer boundaries.
- The court deadline, the procedural standard, and any prior expert reports in the matter.
- A clear statement of privilege boundaries and any material the examiner must not see.
Frequently asked questions
A single-device instruction with a tight scope: two to four weeks from preservation to signed report. Multi-custodian matters with cloud sources: six to twelve weeks. Court deadlines and pre-agreed preliminary opinions can compress this materially.
Yes — a preliminary opinion after preservation and initial triage is standard practice. It answers 'is there a case here' before the analysis budget is committed.
The examiner's duty is to the court, not the instructing party. An independent report that contradicts the pleaded case is a difficult conversation, but it is also — from a professional-conduct standpoint — the point of instructing an independent expert.
Preservation and scoping, yes. Analysis is estimated with a defined ceiling agreed with the instructing solicitor; any variation is discussed and approved before it is incurred.
CPR Part 35 for civil, Criminal Procedure Rules Part 19 for criminal, with methodology aligned to ISO/IEC 27037 and the ACPO Good Practice Guide. The examiner's declaration of duties is on the face of the report.