Inside a digital forensic examiner's working week

A working week in digital forensics is mostly not analysis. It is scoping, confirming your authority to collect, acquiring and verifying, waiting for processing to finish, and then writing — with the writing usually taking longer than the finding. The analysis itself is intense and comparatively short. Anyone who tells you the split is 70/30 one way or the other is describing their own practice, not the field: the proportions differ sharply between a crime lab, a corporate incident-response team and a private consultancy.

Below is the shape of the work rather than a timetable, with the specific artefacts, tools and standards each phase touches. It applies across all three settings; where the settings diverge, the article says so.

What arrives at the start of a matter?

Rarely a device. Usually a request, and the first real work is turning it into a question you can answer.

A useful intake establishes four things: what the requester thinks happened, what decision the answer will inform, what devices and accounts are in scope, and what authority exists to touch them. The fourth is the one newcomers skip and the one that ends careers. An internal investigation needs written authorisation scoped to what will actually be collected; a civil matter needs a preservation instruction and, if the device belongs to an opposing party or a non-party, a court order.

Jones v. Riot Hospitality Group is the most useful modern illustration, because the Ninth Circuit upheld orders directing a party and non-party witnesses to surrender their phones to a jointly retained forensic specialist, having located device-privacy concerns within Rule 26(b) proportionality and Rule 26(c) protective orders and found the orders adequately limited by stipulated search terms and a privilege review. Read it as a template for how to scope an examination rather than as a case about sanctions.

Scoping also means saying what you will not do. A request for "everything on the laptop" is not a scope, and accepting it is how an examination becomes unproportionate, unbillable, or both.

How does acquisition actually consume a day?

Far more of it than the manuals suggest, because the time cost is dominated by the parts that are not imaging.

The imaging itself is mechanical: write-block the source, image, hash, verify. FTK Imager on Windows or ewfacquire on Linux will do it, and ewfverify is the practical way to demonstrate later that the image still hashes to what the acquisition log recorded. A live forensic distribution such as CAINE, which locks all block devices read-only by default, is the answer for a machine you cannot or should not boot normally.

What takes the day is everything around it. Photographing and labelling. Recording make, model, serial, capacity, and the state the device was in when you got it. Deciding whether to capture memory before pulling power, and documenting the decision either way. Working out that the drive is encrypted and that nobody has the recovery key. Discovering the laptop has a soldered drive. SWGDE's best practices for digital evidence collection and for computer forensic acquisitions are the free authorities on what the record should contain, and ISO/IEC 27037 is the standard-level treatment of identification, collection, acquisition and preservation.

On incident-response work the same phase looks different: you are not imaging a hundred machines, you are collecting a defined artefact set from many at once. Velociraptor is the usual instrument, and the collection scope should be auditable — the ForensicArtifacts repository exists partly so that "what did you collect and why" has a defensible machine-readable answer.

What happens while processing runs?

Nothing you can bill for, which is why experienced examiners overlap it with something else.

Ingesting a disk image into a suite, indexing it, carving, and building a timeline are hours-to-days operations depending on media size. Plaso / log2timeline builds the super-timeline; it is the slow step and the valuable one, because correlating many artefact sources onto a single clock is the skill that most distinguishes forensic analysis from log reading. Timesketch then makes the result reviewable — saved searches, tagging, stories that pin an argument to specific events, and per-analyst attribution of annotations, which matters when two examiners on one matter need to see each other's reasoning.

Two things reduce the wait productively. Triage first: collect and parse the artefacts that answer most questions in minutes, review those leads while the full image is still processing. And suppress the noise: loading the NSRL Reference Data Set lets you push known operating-system and application files out of the way so keyword work focuses on user-created data. Remember what a match does and does not mean — presence means "known software", never "benign", and absence means "not in the library", never "suspicious".

A licence note that changes workflows: KAPE is documented as free for government, educational, research and internal company use, and as of 1 January 2026 no longer available for commercial use, meaning third-party networks or paid engagements. If your practice is consulting or expert work, that is a workflow you cannot use.

What does the analysis phase look like hour by hour?

Narrower than people expect. You are usually answering two or three specific questions, and the discipline is to keep answering those rather than exploring.

On a Windows endpoint that means artefact parsing with Eric Zimmerman's tools and RegRipper — shellbags, jump lists, LNK files, registry hives — and knowing for each one what it proves and what it does not. On an intrusion matter it means EVTX triage with Hayabusa and Chainsaw, and then memory: Volatility 3 for plugin-driven analysis and MemProcFS as an independent second parser. On a mobile matter it means running iLEAPP or ALEAPP against the extraction alongside the commercial suite's output, because two differently written parsers reaching the same conclusion about an artefact is a materially stronger position than one vendor's output. For unallocated space and fragments, bulk_extractor — with the understanding that it produces features without context and false positives are routine.

The habit that separates a defensible examination from a fast one is verification: run the decisive question through two tools built on different code, and record both results. That is also the practice the free NIST CFTT programme and Federated Testing suites are designed to support for the tool itself, and what the SWGDE minimum requirements for testing tools describe at standard level.

Where does the client-supplied screenshot fit?

It arrives in almost every matter, and handling it correctly is a recurring part of the week.

Treat a screenshot as the beginning of the work, not evidence. Griffin v. State is the canonical exclusion case for social-media evidence and the source of the three-route roadmap practitioners still use: ask the purported author, examine the device, or obtain records from the platform. Nothing in a printout establishes whose account it was or who wrote the post.

Rossbach v. Montefiore Medical Center is the reason to run the check rather than assume. The Second Circuit affirmed dismissal as a sanction where a photograph of text messages could not have been produced on the device the plaintiff said received them — the exhibit's own artefacts defeated the testimony offered to authenticate it. So the questions to ask on receipt are which device produced this, whether the source still exists, and whether the rendering matches the claimed platform.

How much of the week is writing?

More than analysis, in most practices, and it is the phase most examiners are least trained for.

A report has to state method, state findings, state the limits of the findings, and be reproducible by someone else. The free guidance is better than most paid training: the UK Forensic Science Regulator's expert report content guidance, the ENFSI guideline for evaluative reporting, and ISO 21043-5 on reporting — the last of which is paywalled, so read the free two first. On how strongly a conclusion may be stated, Standardization of forming and expressing preliminary evaluative opinions on digital evidence is the reference, and Error, Uncertainty and Loss in Digital Evidence is the free paper that named the problem.

The standard the writing is held to is not a house style. Federal Rule of Evidence 702, as amended effective 1 December 2023, requires the proponent to demonstrate that it is more likely than not that each reliability condition is met and that the opinion reflects a reliable application of the principles and methods to the facts. In practice that means the weak point in a challenged report is almost never the analysis; it is the explanation.

One cheap lesson from the case law belongs in every examiner's first month. In Lorraine v. Markel American Insurance neither party's electronic exhibits could be considered because none was authenticated — the e-mails were simply attached to the motions. Exhibits attached to a brief are not evidence, and the affidavit or certification that would have fixed it costs almost nothing compared with losing the motion.

What is in the week that nobody bills for?

This is the part that surprises people moving in from IT or from law, and it is not optional.

• Tool validation. Establishing that the version of the tool you used behaves as expected on data with known ground truth. NIST CFReDS supplies the documented images; Federated Testing supplies the methodology and report templates.
• Keeping current. Artefacts change with every OS release. This Week in 4n6 is the cheapest way not to fall behind, and 13Cubed is the fastest way to close a specific gap.
• Continuing education for renewals. A GIAC certification needs 36 CPE credits plus a $499 fee every four years. IACIS's CAWFE renewal requires a proficiency exercise, 40 continuing-education hours and evidence of at least three examinations or active casework — a stronger currency test than credits alone.
• Peer review. Reading a colleague's report before it goes out, and having yours read.
• Testimony preparation. Which is a distinct skill from examination, and largely untaught: SEAK's expert witness training addresses deposition technique and report writing and is explicit that it is training, not certification — there is no recognised licensure for expert witnesses in the United States. The free counterpart is SWGDE's best practices for personnel presenting digital evidence in legal proceedings.

How does the week differ by setting?

	Crime lab or agency	Corporate DFIR	Private consultancy or expert
Work arrives as	A queue with a backlog	An alert or an escalation	An engagement with a scope and a budget
Dominant pressure	Case volume and turnaround	Speed of containment	Billable hours and deadlines
Typical deliverable	An examination report for a prosecutor	An incident report for management	A report, then a deposition
Credential recognised	IACIS CFCE, FSAB-accredited	GIAC GCFA, ANAB-accredited	ISFCE CCE, EnCE
Hardest part	The backlog	Deciding when to stop	Being cross-examined on your method

The three settings reward different things, which is why the honest answer to "which certification should I get" starts with which of these three you want to be in. Our programs directory records, for every entry, who recognises it and what its limitations are.

Is any of this what people imagine?

Partly. The moment where an artefact resolves a question is genuinely as satisfying as it sounds, and it happens often enough to sustain a career. But it arrives at the end of a chain of unglamorous discipline — a documented acquisition, a verified image, a validated tool, a timeline built from several sources, and a conclusion stated no more strongly than the method supports.

If you are trying to find out whether the work suits you before committing money, the fastest test is to work the M57-Patents scenario end to end: daily disk images and RAM captures across four weeks of a fictional company, plus packet captures and simulated case paperwork. It is free, it is designed for exactly this, and it will show you within a weekend which phase of the week you actually enjoy.