1. Start with the decision you need to make
Explain the concern in business terms before asking for a particular forensic tool or device examination. You may need to determine whether an account accessed confidential records, whether company information was transferred, or what happened during a disputed transaction. Each question points towards different evidence and expertise.
Describe the intended use of the findings: internal risk decisions, an employment process, an insurance discussion or potential proceedings. Ask counsel to define any legal requirements. A report prepared for management is not automatically suitable for every later purpose.
Bring a short chronology, relevant systems and actions already taken. Explain each deadline so the provider can identify genuine urgency.
2. Expect a written scope with explicit limits
The proposal should identify the questions, authorised data sources, relevant dates, initial deliverables and exclusions. Specify who can approve additional work. Avoid an open-ended instruction to investigate everything or a narrow instruction that predetermines the answer.
Focused collection can be appropriate, but its limitations need attention. SWGDE’s guidance calls for documenting the reasons for selecting particular sources and time periods, along with constraints and exclusions. It also warns that a narrow collection can omit relevant material. [1]
Ask how the scope will adapt if the initial evidence points elsewhere. A useful change process explains the new question, expected value, additional access and cost before approval. Also agree a stopping point: when the available evidence answers the question, or when further work is unlikely to resolve it.
3. Meet the people who will perform the work
Ask who will collect the material, who will analyse it and who will review the conclusions. Request evidence of experience with the actual environment involved. Mobile-device examination, cloud-account investigation and workstation analysis are related disciplines, but capability in one does not establish competence in all three.
SWGDE’s computer-examination guidance addresses qualified personnel and stresses that conclusions should be supported by the data. [2] Ask how the provider checks important findings, handles tool limitations and records deviations from its normal process. An anonymised sample report can help you assess clarity without requesting another client’s confidential information.
Clarify subcontracting, conflicts of interest and access to the evidence. If testimony may be required, agree its scope separately with counsel and the examiner.
4. Understand the stages and your part in them
NIST distinguishes collection, examination, analysis and reporting. Collection obtains the relevant material; examination extracts information; analysis relates it to the questions; reporting explains the results and methods. Receiving a forensic image or a tool export is therefore different from receiving an analysed answer. [3]
For each stage, agree what your team must provide and what the provider will return. Cloud access may require an authorised administrator, while device collection may require physical availability and coordination with operations. Identify dependencies early.
Set a reporting rhythm. An urgent, well-supported finding may need immediate escalation before the final report. Interim updates should label provisional conclusions and unresolved questions so management can act without mistaking incomplete work for a finished assessment.
5. Ask what could prevent a reliable answer
Ask the examiner to explain relevant limitations before promising outcomes. SWGDE identifies factors such as encryption, proprietary systems and complexity of the evidence, and notes the need to consider examination-tool limitations. [2] Available records may support some questions more strongly than others.
A careful provider should distinguish “we found evidence of this activity” from “we could not determine whether it happened.” If logs were never recorded or have expired, the report should explain the resulting gap. Absence of a finding needs to be interpreted within the sources and period actually examined.
Use a simple question at each update: what would change your current conclusion? The answer reveals whether the team has tested competing explanations and which missing material matters. Be cautious about promises to recover every deleted file, identify every actor or guarantee a particular legal result.
6. Agree how cost and timing will be controlled
Request an estimate built around assumptions: number and type of sources, available access, data volume, required analysis and reporting depth. Ask which items are fixed and which depend on discoveries. An urgent mailbox review and an examination spanning many devices should not be compared solely by headline price.
Agree checkpoints at which the provider reports progress, remaining uncertainty and the next proposed work. Where appropriate, separate initial scoping from deeper analysis so the business can make an informed decision about expansion.
Put practical questions in the engagement: who approves extra hours, how delays are communicated, whether travel or specialist services are separate, and what happens if the key evidence is unavailable. A credible timetable states dependencies and assumptions instead of promising certainty before the material has been assessed.
7. Specify a report that decision-makers can use
Ask for an executive explanation supported by sufficient technical detail. SWGDE’s report-writing requirements cover the purpose and scope, identified evidence, examination processes, results, the basis for opinions and the disposition of evidence. They also distinguish a full examination report from automated tool output. [4]
The report should answer each agreed question, distinguish findings from interpretation and describe unresolved limitations. Request references that let an authorised reviewer trace a material conclusion back to its supporting evidence. Technical appendices can carry detail without obscuring the main decisions.
Agree how corrections or new evidence will be handled. Assess the completed work against its scope and reasoning, independently of the outcome originally hoped for.
8. Plan the handover before the engagement ends
Agree who retains originals, working material and reports; where they are stored; and how authorised future access will work. NIST’s preservation guidance addresses secure storage, integrity records and the practical demands of long-term retention. [5] Have business and legal owners approve retention and disposal arrangements.
Before signing, use this checklist to close the remaining gaps:
- Defined questions, authority, data sources and exclusions.
- Named examiner, reviewer and any subcontractors.
- Secure access, transfer and storage arrangements.
- Cost assumptions, update schedule and expansion approval.
- Clear report format, limitations and evidence handover.
- A named owner for decisions after the findings arrive.
