Digital Evidence Acquisition & Analysis Protocol
Acquire, preserve, and analyze digital evidence with forensic integrity and legal admissibility
What You Can Do
You can manage the complete digital evidence lifecycle—from initial device assessment through expert testimony preparation. This skill ensures forensic soundness, legal admissibility, and compliance with evidentiary standards (Daubert, FRE 702) while documenting proper chain of custody procedures. You'll generate forensically valid reports that clearly explain methodologies to non-technical audiences and prepare materials that defend your findings under cross-examination.
Features
Classify evidence items by type, operating system, and acquisition requirements to select appropriate forensic tools
Document acquisition procedures (bit-for-bit copying, write-blocking, hash verification) that demonstrate legal admissibility
Create detailed evidence logs tracking possession, handling, and analysis from seizure through disposition
Systematically search, extract, and correlate recovered data (files, artifacts, timelines) relevant to investigation objectives
Write court-ready reports that explain forensic methodologies, findings, and conclusions in language accessible to judges and juries
Develop materials addressing common defense challenges, Daubert challenges, and cross-examination scenarios
Track relationships between multiple evidence items and data sources to build coherent investigative narratives
Example Output
Forensic Imaging Report Excerpt:
- Device: Apple iPhone 12 Pro (Evidence #2024-001)
- Acquisition Method: Logical extraction via Cellebrite UFED (write-blocked environment)
- Hash Value (MD5): a1b2c3d4e5f6... [Original/Acquired match verified]
- Chain of Custody: 4 documented transfers, final analyzed by SA Rodriguez on 2024-01-15
- Key Findings: 47 deleted SMS messages recovered from WhatsApp database; timeline correlation with incident window; metadata inconsistencies noted
Analysis Summary Chart:
✓ Boot artifacts analyzed (system logs, prefetch files)
✓ Browser history cross-referenced with network logs
✓ Deleted file recovery completed and classified
✓ Timeline reconstruction: suspect device active 11:34 PM–12:47 AM (incident window)
✓ Methodologies documented for Daubert compliance
What's Included
- SKILL.md: Complete digital evidence protocol with workflows for acquisition, analysis, documentation, and reporting
- Evidence Acquisition Checklist: Step-by-step procedure covering device seizure, write-blocking, imaging, and hash verification
- Chain of Custody Template: Standardized form tracking evidence possession, handling, and analysis from initial seizure through final disposition
- Expert Report Framework: Structured outline for forensic reports addressing methodology, findings, limitations, and conclusions for legal admissibility
- Testimony Preparation Worksheet: Guidance for addressing Daubert challenges, cross-examination scenarios, and expert qualification questions
Who It's For
- Digital forensic scientists conducting criminal and civil investigations
- Law enforcement investigators managing computer and device evidence
- Cybercrime specialists analyzing seized electronics for financial or identity crimes
- Corporate security teams handling internal digital investigations with legal implications
- Legal professionals (prosecutors, defense attorneys) preparing digital evidence for trial
Best For
- Forensic imaging of computers, phones, tablets, and storage media
- Chain of custody documentation and evidence preservation
- Expert report generation for court admissibility
- Analysis of recovered data (deleted files, communication history, artifacts)
- Testimony preparation defending forensic methodologies and findings
You might also like
You can rapidly analyze disparate incident intelligence—surveillance observations, suspect history, behavioral indicators, and site conditions—to produce comprehensive risk profiles that guide tactical decision-making. The skill generates operationally prescriptive assessments that clearly identify threat level, required assets, officer safety considerations, and contingency planning, helping you determine whether standard patrol or tactical units should handle apprehension, and ensuring warrant service and containment operations are informed by documented threat justification.
by geemal2004
You can orchestrate recovery operations spanning months or years by coordinating multiple agencies, tracking resource deployment, and assessing evolving community needs. Claude helps you document recovery priorities, identify unmet needs by sector (housing, debris, utilities, mental health), and generate compliance-ready status reports that keep FEMA, state emergency managers, and elected officials informed. This skill bridges the gap between emergency response and sustained recovery by managing complexity across jurisdictions without losing sight of individual survivor needs.
by geemal2004
You can convert raw DNA laboratory data, mixture interpretations, and statistical findings into structured, defensible forensic reports aligned with SWGDAM guidelines and legal standards. The skill helps you organize complex genetic evidence across multiple data streams—profiles, CODIS matches, population statistics, and mixture resolutions—into coherent case narratives that maintain scientific precision while remaining accessible for expert testimony. You'll reduce report preparation time by 40-60% while improving consistency and legal defensibility across DNA cases.
by geemal2004
You can conduct structured fire code violation assessments that transform raw inspection data into enforceable compliance documentation. The skill maps violations to specific code sections, stratifies risk from immediate threats to administrative issues, and generates notice-of-violation orders with clear corrective action timelines and appeal-resistant reasoning chains that hold up under administrative hearings and legal challenge.
by geemal2004
This skill systematically validates chain-of-custody records for digital forensic evidence against federal, state, and local legal standards. You input your CoC documentation and the skill identifies gaps, inconsistencies, and procedural violations that could compromise evidence admissibility, then generates defensible narratives explaining how evidence remained uncontaminated throughout collection, storage, and analysis.
by geemal2004
You can create defensible chain-of-custody documentation that proves digital evidence remained unchanged and legally handled from acquisition through court presentation. This skill guides you through systematic logging of every custody transfer, access event, storage condition, and handler—building an unbroken narrative that satisfies legal standards and withstands adversarial scrutiny. By using structured protocols and Claude verification, you eliminate documentation gaps that could render evidence inadmissible.
by geemal2004
You can organize complex trace evidence cases from evidence intake through expert report generation. The framework guides you through meticulous documentation, comparative microscopy protocols, interpretation of transfer mechanisms, statistical significance assessment, and preparation of expert testimony materials. This ensures your findings are scientifically defensible and properly contextualized for criminal proceedings.
by geemal2004
You can organize and analyze complex fire investigation data including physical evidence, witness testimony, environmental conditions, and building systems information to identify fire origin and probable cause. Claude helps you cross-reference evidence against NFPA 921 guidelines, synthesize large documentation volumes, and build defensible timelines—all while you maintain investigator authority and scene expertise. The skill supports both administrative findings and legal proceedings with methodical documentation.
by geemal2004