Examination Scope
Definition
The defined boundaries of a forensic examination: what evidence was examined, what questions were asked, what time periods were covered, and what data categories were included. Data outside the scope is not examined and should not be the basis for any conclusion.
- Defines
- Evidence examined, questions asked, time periods, data categories
- Rule
- Data outside scope must not support any conclusion
- Context
- Mobile and network forensic reporting and testimony
- Purpose
- Keeps conclusions tied to what was actually examined
Common questions
Why must an examiner refuse to draw conclusions from out-of-scope data?+
Data outside the stated scope was not systematically examined, so any conclusion drawn from it lacks the same rigor and completeness as the in-scope analysis, and opposing counsel can challenge it as an unsupported afterthought.
Can examination scope be expanded after the report is written?+
Yes, but expanding scope typically requires a new or supplemental examination and report, since the original conclusions were only tested against the original scope and should not be silently extended.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Daubert / Frye Split
- Two competing standards for expert testimony admissibility in the US. Daubert (1993) uses a multi-factor reliability test applied by the trial judge....
- Daubert Standard
- The US federal evidentiary standard (Daubert v. Merrell Dow Pharmaceuticals, 1993) requiring that expert testimony be based on scientifically valid methods with...
- Expert Witness
- A person whose specialised knowledge is accepted by a court and who gives opinion evidence, not just factual evidence. Forensic auditors frequently...
- Hash Verification
- The process of computing a cryptographic hash (SHA-256 or equivalent) of the exhibit file and comparing it against a previously recorded value...