All questions Expand sections ＋ 01 Examination of websites and web pages 20 ⌄ 02 Examination of screen captures (screenshots) 18 ⌄ 03 Date and time of digital events 13 ⌄ 04 Examination of electronic files 17 ⌄ 05 Identity and integrity of digital data 9 ⌄ 06 Origin of files from the internet 10 ⌄ 07 Examination of web browsers 12 ⌄ 08 Optical and other digital storage media 16 ⌄ 09 Examination of video files 15 ⌄ 10 Completeness and reproducibility of digital recording 10 ⌄ 11 Comparison of digital materials and documents 9 ⌄ 12 General computer forensic examination questions 8 ⌄ 13 Computers, laptops, mobile devices and storage drives 12 ⌄ 01 What are the hardware configuration, technical specifications and actual condition of the device provided? 02 According to the available technical information, which drives and other data storage devices are installed in or have been connected to the device examined? 03 Are there signs of replacement, repair or modification of hardware components? 04 Are there signs of malfunction, overheating, liquid damage, mechanical impact or other effects? 05 Which operating system is installed on the device, and what configuration information is available for examination? 06 Which user accounts are present on the device, and what technical information about them is available? 07 Which programs are installed on the device, and is information available about when they were installed or used? 08 Does the device contain files, directories or other data with the specified characteristics? 09 Is technical information available about deletion, movement or renaming of the files of interest? 10 Can deleted files or individual fragments be recovered from the storage medium provided? 11 Are there signs of external USB drives or other peripheral devices being connected? 12 Which technical circumstances of device use can be established from system data and event logs? 14 Software, source code and mobile applications 12 ⌄ 15 Databases, SQL and event logs 12 ⌄ 01 What is the structure of the database provided, and which tables, fields, keys and relationships does it contain? 02 Which records and values are contained in the database under the specified criteria? 03 Is information available about creation, modification or deletion of the records of interest? 04 Which user or application operations are reflected in the database logs? 05 Can the sequence of changes to a particular record be established from the available logs and backups? 06 Are data in different tables, exports, backups or information systems consistent with each other? 07 Are there signs of manual data modification outside the standard application interface? 08 According to the technical information provided, which SQL queries or operations could have caused the recorded data change? 09 Do the event logs contain information about errors, failures, locks, refusals or unsuccessful operations? 10 Can the sequence of actions by a user, application or system process be reconstructed from the logs provided? 11 Are there contradictions between database timestamps, system logs and other sources? 12 What additional logs, dumps or backups are needed to check the disputed event? 16 Electronic correspondence, email and messengers 25 ⌄ 01 What technical information is contained in the electronic message or correspondence file provided? 02 Does the email contain technical headers that allow its transmission route to be examined? 03 Which sender and recipient addresses are specified in the email's technical headers? 04 Which date, time and time zone are reflected in the message's technical data? 05 Are there signs of forwarding, resaving, export or conversion of the correspondence provided? 06 Is the correspondence file provided an original electronic object, export, screenshot or other derivative representation? 07 Are there technical signs of editing in the correspondence image provided? 08 Do the data provided establish message continuity and sequence? 09 Can messages be technically matched to attached files and their relationship established? 10 What additional data—original emails, export, backup, device or server data—are needed to check the correspondence? 11 Which WhatsApp messages and attachments are contained in the materials provided for the specified period? 12 Which WhatsApp contact or group details can be recorded? 13 Are the WhatsApp messages in screenshots consistent with the supplied chat export? 14 Does the supplied WhatsApp correspondence package contain gaps or discrepancies requiring verification? 15 Which limitations of the WhatsApp material prevent the time, sequence or origin of a message from being established? 16 Which Telegram messages and attachments are accessible in the chat or publication examined? 17 Which Telegram account details are displayed in the source and contained in the export? 18 Does the content of the specified Telegram messages match across the versions provided? 19 Which signs of Telegram message editing or forwarding can be observed? 20 Do the Telegram source data allow the sequence of selected messages to be reconstructed, and what are the limitations? 21 Which sender, recipient and identifiers are specified in the original email messages? 22 What information about transmission of the email message is available in its full technical headers? 23 Are the Date field and available mail server timestamps consistent? 24 Do the email attachments match across the packages provided by the parties? 25 Are the email data sufficient to conclude that a particular message was delivered, and what are the limitations of that conclusion? 17 Networks, servers and cloud infrastructure 10 ⌄ 18 IT project, technical specifications and acceptance 10 ⌄ 19 Review of computer forensic and IT expert reports 34 ⌄ 01 Do the questions put to the expert correspond to the objects and materials actually submitted for examination? 02 Are the source data described in the report sufficient to reproduce the examination conducted? 03 Does the report specify the software used, its versions, equipment and significant examination parameters? 04 Is the examination methodology described sufficiently to verify the sequence of actions performed? 05 Do the examination section and technical data presented support the conclusions drawn? 06 Are there internal contradictions between object descriptions, examination results and conclusions? 07 Have technically significant properties of electronic objects—metadata, checksums, timestamps and origin—been considered? 08 Has the integrity of the digital objects examined been checked, and is their identification method described? 09 Does the report contain conclusions beyond the technical examination described? 10 What additional examinations or source materials are needed to verify the conclusions drawn? 11 Which specific objects, software versions, datasets and periods are examined in the report, and do they match the objects specified in the questions raised? 12 Does the information in the report establish the origin of the files examined and the sequence of their acquisition, copying and transfer? 13 Does the report distinguish examination results from original digital objects and results from studying their copies, screenshots, printouts or retellings? 14 What limitations on the conclusions arise from missing original files, storage media, event logs or other primary digital data? 15 Are data extraction methods and measures for detecting changes to the examined object during acquisition and analysis described? 16 Which conditions, environment settings, input data and action sequence must be reproduced to verify each significant examination result? 17 Are the technical methods selected appropriate to the properties of the objects examined and the tasks formulated in the expert's questions? 18 Are limitations of the methods and software used stated where they could affect completeness of data detection or accuracy of result interpretation? 19 Has the applicability of the technical documents, standards and reference sources used to the software versions, equipment and operating conditions examined been confirmed? 20 When comparing timestamps, have time zones, clock settings, possible clock discrepancies and date conversion during export been considered? 21 Does the scope of logs, database records or correspondence examined allow the completeness of the described event sequence to be checked and significant gaps identified? 22 Has a technical connection been established between the source code examined, software build and version actually used during the disputed period? 23 Have the software product's identified properties been compared with specific technical requirements, criteria and verifiable scenarios in the examination materials? 24 Do the tests described distinguish a software defect from the effects of settings, source data, infrastructure, access permissions or external services? 25 Which technically possible alternative causes of the failure or data change identified are considered in the report, and which results support or exclude them? 26 Are the technical data presented sufficient to conclude that the established events are causally connected, rather than merely coinciding in time? 27 Is the selection of files, records or test scenarios examined substantiated, and does it allow conclusions to extend to the entire stated object? 28 Can the quantitative results, calculations and metrics presented be checked using the specified source data, formulas, units of measurement and rounding rules? 29 Do references to annexes, illustrations, tables, code fragments and event logs correspond to the results they are cited to support? 30 Are there significant differences between the electronic data examined and their presentation in the report's illustrations or tables, and how do these affect verification of the conclusions? 31 Do the report materials distinguish information obtained independently by the expert from the parties' initial assertions and unchecked assumptions? 32 Does the degree of certainty of each conclusion match the scope of data examined and the technical limitations stated in the report? 33 Have all technical questions raised been answered, with the examination results supporting each answer provided? 34 Which identified shortcomings in the description or examination materially limit verification of specific conclusions, and what additional data or actions are needed to check them? 20 Checking an internet resource inspection record or report 16 ⌄ 21 Technical reproducibility of digital inspection 14 ⌄ 01 Can another specialist reproduce the described action sequence using only the document provided? 02 Can the search queries, navigation between pages and sequence of opening internet resources be reproduced? 03 Are the stated internet addresses sufficient to open the exact pages recorded in the inspection materials? 04 Which additional parameters are required to reproduce the result: login state, cookies, cache, geographical location, interface language or other settings? 05 Can it be established whether VPNs, proxy servers or other network route modification tools were used? 06 Can the specified equipment technically perform all actions described in the document? 07 Are the displayed interfaces compatible with the stated hardware and software environment? 08 Did acquiring or saving the materials examined require additional operations not reflected in the document? 09 Can it be determined whether the digital object was obtained by direct file download, stream capture, screen recording or another method? 10 Was the entire action sequence recorded continuously, or were only individual intermediate results saved? 11 Can the actions performed between two successive screenshots be established? 12 Can other actions between individual recording points be ruled out? 13 Are software, equipment and acquisition condition details sufficient for another specialist to repeat the procedure? 14 What additional source data are needed for reproducible independent verification? 22 Internet information source, domain and infrastructure 14 ⌄ 23 Accounts, material posting and technical attribution 14 ⌄ 24 Views, subscribers, likes, tags and platform metrics 15 ⌄ 25 Cloud synchronization and digital object chain of custody 12 ⌄ 26 Machine translation of web pages and digital materials 10 ⌄ 27 Comparison of materials from several inspections or examinations 11 ⌄ 28 Technically significant internet platform rules and mechanisms 8 ⌄ No questions found Try another word, change the category or reset the filters.
Reset filters How to formulate examination questions Choose a category or use the search. Select the wording you need; selected questions can be copied as one block. Searching and changing categories preserve your selection.
This list is not exhaustive. Before an examination is ordered, discuss the questions with a specialist: whether they can be resolved depends on the availability of original files, storage media, metadata, event logs and other data.
Questions best avoided when instructing a technical expert “Did the defendant violate legal requirements?” “Was the contract performed properly?”—without identifying specific technical requirements. “Who is at fault for the damage or failure?” “Is the evidence procedurally admissible and reliable?” Instead of seeking a legal assessment, identify specific technical facts that can be established through examination.
