Forensic Services Editing and Proofreading Services

A digital forensics examiner produces a report concluding that a departing employee copied a client list to a personal drive. Under cross-examination the examiner is asked whether the file could have been written by the company's own backup software rather than by a person, and concedes it could. The report had stated the conclusion without ever addressing the alternative, and the examination that follows is not about the evidence but about what else the examiner did not consider.

We edit what forensic services providers produce — digital forensic examination reports and findings, chain of custody documentation and evidence logs, imaging and acquisition records, expert witness reports and declarations, laboratory examination reports and method documentation, case notes and contemporaneous records, engagement letters and scope-of-examination agreements, peer review and quality assurance records, and testimony preparation summaries. Our editors work on the report an opposing expert reads looking for what it left out.

The examination report is written to be attacked by someone qualified to attack it, and its failure is a conclusion stated without the alternative explanations that a competent opponent will raise immediately. We work through these so each conclusion is accompanied by the alternative explanations considered and the specific evidence that made them less likely, rather than presented alone as though no other reading existed, since the alternative raised first in cross-examination is the one the report should already have addressed; so what the examiner observed is separated visibly from what the examiner concluded, given that an artefact and an inference about how it got there are different claims carrying different weight; so the limits of the method are stated — what the tool used can and cannot establish, what a timestamp does and does not prove about human action — because an examiner who has not stated a limit will be asked to concede it under oath instead; so the chain of custody is recorded as specific transfers with times, people and container identifiers rather than a general assertion that custody was maintained, since this is the first thing an opponent moves to exclude on; and so the report distinguishes what was examined from what was available but not examined, given that scope decisions look like omissions once someone else names them first. Reports written this way survive being read adversarially.

Everything you send is treated in confidence, including case materials, examination findings and client information. We are editors rather than forensic examiners, technical analysts or expert witnesses, and we offer no view on findings, methodology or the interpretation of evidence. What we can do is make sure the report anticipates the reader who is trying to break it.