Procedures and Methodology · Topic 3 of 11
Analysis, Reporting, Expert Testimony and Mobile Forensics
Data and case analysis, forensic reports, expert witness testimony, Electron and chat app artifacts, and the mobile forensics process and worksheet.
- 5 min
- Analysis is performed on a verified copy, never on the original.
- Case analysis tests hypotheses and separates facts from opinion.
- A report has an executive summary, scope, evidence, method, findings and conclusions.
What it is
After evidence is preserved, the investigator acquires data, analyzes it, ties the findings into a case, writes a report and may testify. Each step must be traceable to the evidence and free of speculation.
This page also covers two common sources of modern evidence: desktop chat applications built on Electron and mobile devices. The exam asks about the order of steps, what belongs in a report, and how an expert witness behaves.
How it works
Data acquisition and data analysis
Acquisition produces a verified forensic copy. Analysis is done only on that copy. Analysts search file systems, deleted data, logs, registry, browser records and communications for items relevant to the question being asked.
Keep the scope tied to the authority and the case. Record every search term, tool and version, so that another examiner can repeat the work.
Case analysis
Case analysis joins the technical findings into a coherent account of what happened. It answers who, what, when, where and how.
- build a timeline from file system times, logs and application records
- link users, devices and accounts to actions
- test more than one hypothesis, including ones that clear the suspect
- note gaps and limits, such as missing logs
- separate facts that the evidence shows from opinions drawn from them
Reporting and generating the investigation report
A report must be clear to a non-technical reader, factual and complete. Typical structure:
| Section | Content |
|---|---|
| Executive summary | Short statement of purpose and outcome |
| Case details | Case number, dates, requester, examiner |
| Scope and authority | What was examined and under what authority |
| Evidence list | Items, serial numbers, hashes, chain of custody |
| Methodology and tools | Steps taken, tools and versions |
| Findings | What was found and where, with supporting artifacts |
| Conclusions | Opinions supported by the findings |
| Appendices | Logs, screenshots, glossary, examiner CV |
Use neutral wording. Do not include opinions about guilt. Include limitations honestly, and sign and date the report.
Testifying as an expert witness
An expert witness is allowed to give opinions based on specialized knowledge. In the United States, the court applies standards such as the Daubert test and Federal Rule of Evidence 702 to decide whether the expert and method are reliable.
Good conduct on the stand:
- stay objective and independent, not an advocate for either side
- explain technical points in plain language
- answer only the question asked
- admit what you do not know or did not examine
- bring the notes, report and curriculum vitae
- be prepared for direct examination and cross examination, and for a deposition before trial
A fact witness reports what they saw or did, while an expert witness may also give opinions.
Electron applications and chat application forensics
Electron lets developers build desktop apps from web technology, so apps such as Slack, Discord, Signal Desktop and the classic Microsoft Teams client store data like a browser. On Windows, much of this lives in the user's %AppData% folder.
| Data type | Where it often appears |
|---|---|
| Cache | Cached images, files and web responses |
| Local Storage and Session Storage | Settings, tokens, small data items |
| IndexedDB and LevelDB | Messages, channel and contact data |
| SQLite databases | Message histories in many chat apps |
| Logs | Connection events, errors, timestamps |
Some apps encrypt their local database, and the way the key is stored depends on app and version. Always acquire the user profile folder and also check the cloud account, because the service may hold more than the device.
Mobile forensics process
| Step | Notes |
|---|---|
| Seizure and isolation | Keep the device powered if on, block the network with a Faraday bag or airplane mode, record device state |
| Documentation | Photograph the device, note model, IMEI, serial number, lock status |
| Acquisition | Logical (files and data through the OS), file system, physical (a full bit copy), and specialist methods such as chip off or JTAG |
| Examination and analysis | Parse contacts, calls, messages, apps, location, media |
| Reporting | Findings, method, tool and version, limitations |
Hash what can be hashed, and remember that mobile acquisition can change data on a live device, so each action is recorded.
Mobile forensics report template and analysis worksheet
A mobile report or worksheet captures the same core facts for every device. Typical fields:
- case number, examiner, date and time, location
- device make, model, serial number, IMEI, phone number and SIM details
- operating system and version, and lock status
- condition and accessories, with photographs
- acquisition method, tool name and version, and hash values
- data categories found, and key artifacts with their timestamps
- chain of custody and examiner signature
A worked example
A phone is seized in a fraud case. The responder places it in a Faraday bag and records the model and IMEI. The examiner performs a file system acquisition and records the tool version and hash.
The worksheet lists the messages and location points that support the timeline. The report states the facts, the limits and the conclusion, and the examiner prepares for cross examination.
How the exam asks about this
- "Which part of a report is read first by management?" → The executive summary.
- "What standard decides whether an expert's method is reliable?" → The Daubert standard (with Rule 702).
- "What is the first step when a live phone is seized?" → Isolate it from the network, for example with a Faraday bag.
What to remember for the exam
- Analysis is performed on a verified copy, never on the original.
- Case analysis tests hypotheses and separates facts from opinion.
- A report has an executive summary, scope, evidence, method, findings and conclusions.
- An expert witness is objective, explains plainly and answers only what is asked.
- Mobile process: seize and isolate, document, acquire, examine, report.
A report that states opinions beyond what the evidence supports damages the examiner on cross examination. Tie every conclusion to a finding.
Common mistakes
Mixing facts and opinion. State what was found first, then clearly labeled conclusions.
Skipping the tool version. Without it the work cannot be repeated or defended.
Looking only on the device. Chat and mobile data are often also held by the cloud service.
Check yourself
Which test is used in US courts to judge an expert's method?
The Daubert standard, together with Federal Rule of Evidence 702.
What does case analysis do?
It links the technical findings into a timeline and account of who, what, when, where and how.
Why isolate a seized phone from the network?
To stop remote wipes and incoming data from changing the evidence.
Topic 3 of 11 in Procedures and Methodology
Test yourself on Procedures and Methodology
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.