What does a digital forensics opinion look like? A comparative study of digital forensics and forensic science reporting practices.

This study explores digital forensics (DF) reporting practices and compares the results with other forensic science disciplines. Forty reports were obtained from a quasi-experiment involving DF examiners, and a quantitative content analysis was performed to determine which conclusion types they applied and which content they included with relevance to the credibility of the reported results. A qualitative analysis was performed to examine the certainty expressions used in the conclusions. The results were compared to a study of eight forensic science disciplines performed by Bali et al. [24,26]. The results show that the DF examiners tend to present their conclusions either as Categorical conclusion or Strength of support (SoS) conclusion types and that they address source, activity, and offence level issues in their conclusions. The content analysis indicates deficiencies in DF reporting practices, and several of the challenges seem to be shared with other FS disciplines. The analysis of certainty expressions showed that a plethora of expressions was used, and that they lacked reference to an established framework. The results indicate that more research on DF evaluation and reporting practices is necessary and justifies a need for enhanced focus on quality control and peer review within the DF discipline.