The forensic process: imaging, hashing, analysis and reporting

Mei Lam has been a digital forensic examiner with the Port Ardent police department for nine years, after a career in information technology. On the morning of March 20 she received Pike's two phones, still sealed, checked the seals against the exhibit log and photographed them before opening the packages. She then read the warrant that authorized the search of the phones. It permitted her to search for communications, contacts, call records, location data, financial records and images relating to fraud and the collection of money from older people between January 1 and March 19, 2026. She wrote the scope at the top of her notes. Desjardins tells the class that this is where the examination begins: not with a tool, but with the authority.

Lam visits the class for this lesson. She tells them they will not become examiners, but every officer who seizes a device, writes a warrant application or testifies about digital evidence needs to understand what examiners do, why they do it that way, and what their results can and cannot show.

The stages of a forensic examination

Digital forensic examinations follow a recognized process, set out in international standards such as ISO/IEC 27037 for identifying, collecting and preserving digital evidence, and in guidance published by police and government bodies. The stages are preparation, acquisition, verification, analysis, reporting and review. Preparation means confirming the authority and its limits, understanding the investigative questions, and planning. Acquisition means making a copy of the data. Verification means proving the copy is accurate. Analysis means finding and interpreting the relevant data within the authority. Reporting means explaining the findings clearly. Review means having another qualified person check the work.

Laboratories that do this work increasingly seek accreditation under the international standard for testing laboratories, ISO/IEC 17025, which requires documented methods, validated tools, trained staff, quality controls and proficiency testing. Accreditation does not guarantee that every conclusion is right, but it shows that the laboratory has systems designed to catch errors.

Acquisition: making a copy

Examiners almost never analyze the original device directly. Instead they make a copy and work on the copy, so that the original is preserved and any analysis can be repeated. For computers and storage drives, the standard method is a forensic image: a bit-for-bit copy of the entire storage, including empty space where deleted data may remain. The drive is connected through a write blocker, a hardware or software device that lets data be read but prevents anything from being written to the drive, so the act of copying does not change the evidence.

Phones are harder. Their storage is built in and encrypted, and they cannot simply be connected through a write blocker. Examiners use specialized tools that extract data in different ways, from a logical extraction, which collects data the phone's operating system makes available, such as contacts, messages and photos, through a file system extraction, which collects the phone's files including app databases, to a full extraction that captures as much of the storage as possible. Some extractions require the device to be running and may require loading software onto it, which changes it slightly. That is acceptable when unavoidable, provided the examiner records what was done and can explain its effect, as the principles in lesson 7 require. Lam obtained a full file system extraction from Pike's first phone and a logical extraction from the second, older phone.

Verification: hash values

The evidence course introduced hash values. A cryptographic hash function takes any amount of data and produces a fixed-length value, often written as a long string of letters and digits. The same data always produces the same value, and any change to the data, even one bit, produces a completely different value. It is not practical to find two different sets of data with the same value using modern functions such as SHA-256. Examiners calculate the hash value of an image or extraction when it is made, and again when it is copied or used, to show that it has not changed. Where possible, they also hash the source, so the image can be shown to match it.

# Hash values change completely when data changes by one character
import hashlib
original = b"Mav: blue door, dont knock twice"
altered  = b"Mav: blue door, dont knock twice."
h1 = hashlib.sha256(original).hexdigest()
h2 = hashlib.sha256(altered).hexdigest()
print("original:", h1)
print("altered: ", h2)
same = sum(1 for a, b in zip(h1, h2) if a == b)
print("matching characters out of 64:", same)
print("identical:", h1 == h2)

original: 9316fefae662fe25d26f2b168e649782dd221bd7c1707b667d50f550259163d3
altered:  4663fadaa63593799f194ae56e67f72c01123a03729a6857c0998c0bccfbb4fc
matching characters out of 64: 7
identical: False

Adding a single full stop changes the hash value beyond recognition; the few characters that happen to match in the same positions do so by chance. In court, Lam does not need to explain the mathematics. She needs to explain what the value is, when she calculated it, and that the values calculated at acquisition and before trial were identical. Desjardins notes that hash values prove the copy is unchanged since it was made. They do not prove that the device itself was not changed before it reached the examiner. That depends on the seizure and handling covered in lessons 7 and 8.

Analysis

Analysis is guided by the questions in the investigation and limited by the authority. Lam's questions were: who was 'Mav', and what other accounts did he use? What did Pike know about where the money came from? How many collections had he made, from whom and where? What was he paid, and by whom? And was there any link to Grace Whitford's case? Her tools parsed the messaging app's database, the phone's call log, its photos with their location metadata, its location history and the banking app's cached data. She searched within the warrant's date range and subject matter. When she found files outside the scope, such as personal photos unrelated to the investigation, she did not examine them further.

The analysis found that Pike had been in contact with 'Mav' since February 2, after answering an advertisement for a 'courier driver, cash paid daily' on a social media marketplace. 'Mav' sent him addresses, times and instructions for six collections between March 3 and March 19 in Port Ardent and two nearby towns. The messages included 'if anyone asks ur a driver for ur cousin' and, after the second collection, 'the old ones never check'. The banking app on the second phone showed five electronic transfers of 300 dollars each, one after each completed collection, from an account in the name of a woman in another province. Photos on the first phone, taken at each collection, showed bundles of cash on the car seat, with location data placing them at the victims' addresses. Nothing on either phone referred to Grace.

# Building a timeline of collections from extracted messages and payments
collections = [
    ("2026-03-03", "Port Ardent", 8000),
    ("2026-03-06", "Westmere", 6500),
    ("2026-03-10", "Port Ardent", 9500),
    ("2026-03-12", "Harrow Bay", 7000),
    ("2026-03-16", "Port Ardent", 11000),
    ("2026-03-19", "Port Ardent (arrest)", 0),
]
paid = [300, 300, 300, 300, 300]
collected = sum(c[2] for c in collections)
print("completed collections:", sum(1 for c in collections if c[2] > 0))
print("cash collected from victims:", collected, "dollars")
print("paid to the courier:", sum(paid), "dollars")
print("courier's share for every 100 dollars collected:", round(100 * sum(paid) / collected, 1))

completed collections: 5
cash collected from victims: 42000 dollars
paid to the courier: 1500 dollars
courier's share for every 100 dollars collected: 3.6

The analysis answered several questions at once. Five victims had handed over 42,000 dollars, and Pike had been paid 1,500, a little under 4 dollars for every 100 collected. The pay, the instructions and the messages about cover stories and older victims were strong evidence of knowledge. And the five earlier victims, whose losses had been reported as separate frauds, could now be connected to one network. Two had not reported at all, and learned they had been victims when Park's unit contacted them.

Interpretation and its limits

Digital evidence is not self-explaining. A message on a phone shows that the message is in the app's database, not who typed it. A location record shows where the phone was, not who was carrying it. A deleted file that has been recovered shows that the file existed, but its dates may reflect when it was copied rather than when it was made. Time stamps can be recorded in different time zones or affected by wrong device clocks. Examiners must test their interpretations against other evidence and consider alternative explanations, and must say so in their reports.

Tools can also be wrong. Forensic software is complex and is updated constantly to keep up with new phones and apps, and it can misread data, especially from new app versions. Good examiners validate their tools against known test data, compare results from more than one tool for important findings, and look at the underlying data rather than relying only on the tool's summary. Lam checked the key messages by reading the raw entries in the app's database and confirmed that the time stamps were stored in universal time and converted correctly.

Reporting and review

An examiner's report should state the authority and scope, the exhibits received and their condition, the methods and tools used, including versions, the hash values, the findings relevant to the questions, the limits of the findings, and anything found that might help the defense. It should be written so that a judge or jury can understand it, with technical detail in appendices. Before it is released, another qualified examiner should review it. Lam's report ran to 18 pages with 240 pages of appendices. Her colleague reviewed it and asked her to add a sentence explaining that the photos' location data came from the phone's own location services, which can be wrong by tens of meters. She added it.

Desjardins stresses the duty of fairness. Examiners, like other forensic witnesses, serve the court, not the side that calls them. They must report what they found, including findings that weaken the case, and must not overstate their conclusions. The forensic failures examined in the evidence course, in which experts overstated their findings, apply equally to digital forensics.

When the evidence is in the cloud

Increasingly, the most important data is not on the device at all. Messaging apps may keep only recent messages on the phone and older ones in the cloud. Photos may be stored online with only small copies on the phone. Examiners report finding less on devices and more in accounts each year. Data in an account is usually obtained from the provider with legal process, as lessons 10 and 11 describe, rather than by logging into the account from a seized phone, which raises legal and integrity problems. When provider records arrive, examiners treat them like any other evidence: they record how they were received, calculate hash values, check them against the device data, and note any differences. In Pike's case, the messaging app's records of the 'Mav' account's login addresses, produced months later, matched the times when Pike's phone showed new instructions arriving.