Examination scope
Definition
The defined boundaries of a forensic examination: what evidence was examined, what questions were asked, what time periods were covered, and what data categories were included. Data outside the scope is not examined and should not be the basis for any conclusion.
Related terms
- Chain of custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Daubert / Frye split
- Two competing standards for expert testimony admissibility in the US. Daubert (1993) uses a multi-factor reliability test applied by the trial judge....
- Daubert standard
- The US federal evidentiary standard (Daubert v. Merrell Dow Pharmaceuticals, 1993) requiring that expert testimony be based on scientifically valid methods with...
- Expert witness
- A person whose specialised knowledge is accepted by a court and who gives opinion evidence, not just factual evidence. Forensic auditors frequently...
- Hash verification
- The process of computing a cryptographic hash (SHA-256 or equivalent) of the exhibit file and comparing it against a previously recorded value...
Explained in
- Forensic Reporting and Expert Testimony in Mobile and Network CasesThe defined boundaries of a forensic examination: what evidence was examined, what questions were asked, what time periods were covered, and what data categori...