Part VI Checkpoint: Report and Defend
Where you are: Part VI — Professional Practice: Labs, Reports and the Courtroom · Checkpoint · This checkpoint brings together Chapters 12 and 13 of Dr. Al-Doori's IT Forensics Essentials: forensic labs, court reports and testimony.
Part VI Checkpoint: Report and Defend
You have finished Part VI. This checkpoint tests your judgment as a professional: running a lab, writing a report and standing behind it in court. For each scenario, choose what you would do, and then read the model answer. There is no score to record. Allow about 12 minutes.
All people and organizations below are fictional.
Scenario 1: Where Does It Go?
You are writing a report. You have found that a file named bids_2026.xlsx was copied to a USB device at 22:14 UTC, and you believe, from the pattern of earlier activity, that the copying was deliberate preparation for leaving the company.
How should these two statements appear in the report?
Model answer: d. The copy event is a fact, supported by named artifacts. "Deliberate preparation for leaving" is an interpretation: it may be reasonable, but it is your opinion, and the reader must be able to see that and weigh your reasons. Mixing the two (a) makes the report vulnerable in cross-examination. Option c drops the evidence the opinion rests on.
Scenario 2: The Proud Methodology
A colleague's draft methodology section reads, in full: "Industry-standard forensic tools were used in accordance with best practice."
What is the most important improvement?
Model answer: b. The methodology is what lets another examiner repeat the work, and what a court examines to judge reliability. Under the 2023 version of US Federal Rule of Evidence 702, for example, the party offering expert evidence must show that reliable methods were reliably applied. A sentence that names nothing proves nothing. Adjectives (c) are not evidence.
Scenario 3: The Hard Question
In court, opposing counsel asks: "Your report says the login came from 192.168.1.100. That's my client's home IP address, isn't it?"
What is the best answer?
Model answer: d. Private addresses such as 192.168.x.x are reused inside millions of networks, so the same address can exist in a home and in an office at once. The examiner corrects the false premise politely, explains in plain language, and points to the report. Agreeing (a, b) would mislead the court. Refusing (c) abandons the expert's duty to help the court understand.
Before You Move On
If any of these felt uncertain, revisit the lesson behind it: Lesson 6.3 for report structure and wording, and Lesson 6.4 for testimony and cross-examination. Next, Part VII studies ten landmark cases and the techniques that solved them.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapters 12–13
- Cornell Law School LII — Federal Rules of Evidence, Rule 702 (with 2023 amendment notes)
- IETF — RFC 1918: Address Allocation for Private Internets
- Ministry of Justice — Civil Procedure Rules, Part 35: Experts and Assessors