Problem
Forensics fails on procedure, not on the tool. Without “when, from where, who”, later analysis is decoration.
Scope
- lab, workstation or agreed image material
- timeline, accounts, execution, network — within available artefacts
- explicit limits: what is missing, what cannot be proven
Out of scope unless agreed: court expert testimony, working on the only copy of evidence, a promise to recover everything.
Result
An activity log and conclusions that can be defended — or honestly marked as hypothesis.