Stating limitations

Every examination has limits. Some items were not provided, some data was encrypted or overwritten, some tools could not read a format, and some findings fit more than one explanation. A report that hides these limits misleads its readers; a report that states them tells readers exactly how far they can rely on each finding. This lesson covers the kinds of limitation, how to express confidence consistently, and how to avoid saying more than the evidence supports.

Why limitations belong in the report

• Decisions depend on them. A manager or a court acting on a finding must know its boundaries.
• They will be found anyway. An examiner instructed by the other side will look for gaps. A limitation the report already states is a non-event; one discovered later damages the credibility of the whole report.
• Impartiality requires it. The examiner serves the finding of facts, not one party (Module 2), and the limits of the work are part of the facts.

Stating a limitation is not an admission of poor work. It shows that the examiner understands the method well enough to know where it stops.

Kinds of limitation

• Scope limits: what was not examined. Items not provided, accounts or cloud data outside the authorization, a restricted date range, or questions not asked.
• Data limits: what was not available in the data. Encrypted volumes without a key, deleted data that was overwritten or erased by TRIM (Module 1), logs that rotated or were never enabled, damaged media.
• Tool limits: what the tools could not do reliably. A parser that does not support a new app version, known errors in a tool version, or features never validated (ISO/IEC 27041). Tool test reports, such as those of the NIST Computer Forensics Tool Testing (CFTT) program, help examiners know these limits.
• Time and resource limits: a deadline that allowed only keyword searches on some items, or equipment that was not available.
• Interpretation limits: findings that fit more than one explanation, such as a shared account, remote access, malware or an incorrect system clock.

Common limitations and how to phrase them

Good wording states the limitation, its cause and its effect on the findings, without apology or vagueness.

Expressing confidence

Readers need to know how strongly the findings support a conclusion. Two approaches are common.

Verbal scales

A verbal scale uses a fixed set of phrases, such as weak, moderate, strong and very strong support. The scale is defined once in the report, often in an appendix, and the same words always carry the same meaning. Mixing loose terms such as "probably", "likely" and "consistent with" confuses readers. "Consistent with" is a particular trap: it only means that the findings do not contradict an explanation, yet many readers hear it as strong support.

The likelihood framework

In evaluative reporting, the examiner considers two competing propositions, for example "the user copied the files" and "an automatic process copied the files", and asks how much more probable the findings are if one is true than if the other is true. The ratio of those two probabilities is the likelihood ratio, and verbal scales are often mapped to ranges of it. The guideline for evaluative reporting published by the European Network of Forensic Science Institutes (ENFSI) in 2015 is a widely cited example. Under this framework the examiner comments on the findings, not on the probability that a proposition is true; that decision belongs to the court or the decision-maker.

No evidence found is not evidence of absence

"No evidence of malware was found" means that the searches performed did not find any. It does not mean there was no malware. A finding of absence is only meaningful when two conditions are met: the trace would have been created if the event had happened, and the trace would have survived and been found by the methods used. A report should therefore say where and how the examiner looked, for example "No records of USB storage devices were found in the locations listed in Appendix B", and whether traces would be expected there.

Avoiding overstatement

• A device or account is not a person. Activity under an account shows that the account was used, not who used it. Shared passwords, remote access and malware are possible explanations to consider.
• A timestamp is a recorded value. It depends on the system clock and its time zone setting, and it can be altered (Module 6).
• Presence is not knowledge. A file in a browser cache or a downloads folder does not show that the user opened it or knew its content.
• Avoid absolute words such as "proves", "certainly" and "beyond doubt", and legal conclusions such as "stole" or "guilty", which are for the court.

A worked example: rewriting an overstated sentence

A draft report on the Nordvale case (Lesson 7.1) contains this sentence: "The analysis proves that Mr. Marsh stole the design files on 4 March by copying them to his USB drive." It names a person where the data shows only an account, uses "proves" and "stole", assumes who owned the drive, and states copying that was not directly observed.

A better version: "On 4 March 2026, between 09:12 and 09:40 UTC, while the account jmarsh was logged on, a USB storage device with serial number 0A1B2C was connected to Item 1. During that period the server logs (Item 2) record the account reading eleven files in the Hydra folder, and files with the same names were then opened from the device. In my opinion, these findings provide strong support for the proposition that the files were copied to the device using this laptop, rather than reaching the device by another route. The findings do not show who was using the laptop, and the device was not available for examination."

Exam focus: Know the five kinds of limitation (scope, data, tool, time and resources, interpretation) and be able to classify an example. Expect questions on why limitations strengthen a report, consistent verbal scales, the likelihood framework (findings evaluated under two competing propositions), the difference between "no evidence was found" and evidence of absence, and overstatements such as treating an account as a person.