Scope statement
Definition
The formal declaration at the start of a forensic report that defines what question the examiner was asked to answer. A scope statement makes clear whether the examiner conducted an authentication examination, an enhancement examination, or both, and in what sequence.
Related terms
- Authentication forensics
- The examination of a media file to determine whether it is genuine: whether it was created by the claimed device, at the...
- Business continuity plan (BCP)
- A document that specifies how an organisation keeps critical business functions operating during a significant disruption. The IR plan and BCP must...
- Communication matrix
- A structured table in an IR plan that maps incident severity tiers to mandatory notification recipients, timelines, and communication channels. It removes...
- Disaster recovery plan (DRP)
- A plan focused on restoring IT systems and data after a major failure or destructive event. Often a subset of BCP. The...
- Enhancement forensics
- The processing of a media file to improve the perceptibility of its content, such as denoising, contrast adjustment, or frame interpolation. Enhancement...
- Forensic working copy
- A verified duplicate of the original file, created by hashing the original and confirming hash match, on which processing is performed. The...
- IR plan
- The operational document that translates the policy into specific procedures, roles, severity tiers, communication chains, and recovery criteria. Versioned and reviewed at...
- IR policy
- A management-approved governance statement that commits the organisation to an incident response programme, defines its scope, and grants authority to designated teams....
- Provenance
- The documented origin of a media file: the device that captured it, the time and location of capture, the chain of custody...
- Tamper artefact
- A signal in a media file that indicates manipulation: a discontinuity in compression parameters, an inconsistency in noise profile, a gap in...
Explained in these topics
- Authentication Versus Enhancement: Defining the Examiner's ScopeThe formal declaration at the start of a forensic report that defines what question the examiner was asked to answer. A scope statement makes clear whether the...
- Incident Response Policy and PlanThe section of a policy or plan that defines which systems, data types, locations, and third parties fall within the IR programme's coverage. A narrow scope is...