Specimen examination report
Before you instruct an examiner, ask to see a report. This is mine, published before anyone asks, with every value invented and every block marked.
- Document
- WW-F-013
- Version
- 1.0
- Issued
- 2026-09-11
- Last revised
- 2026-09-11
- Scope
- Specimen report format
- Authority
- Principal
What you end up holding: the question asked, the material with its digests, the method to tool and version, each finding tied to its artefacts, a confidence, and the limits.
What it costs. Examination is $425/hr against a written ceiling, on a published schedule, quoted before I open anything and identical whichever side retains me.
Reading the report served against you is separate work, flat $3,250: I mark each finding supported, partly, unsupported or untestable, and give you the questions to put.
Specimen report
[SPECIMEN — NOT A REAL MATTER]
A form, not an account. Every value is invented, no court is named, and the digests contain P, M and N, impossible in SHA-256. Nothing here implies I have been retained in any matter, or that any report has been served, admitted or tested.
- Matter
- Larkhill Fastenings Inc. [FICTITIOUS]
- Matter reference
- SPEC-0000
- Report reference
- SPEC-0000-R01
- Retaining party
- Counsel [FICTITIOUS]
- Role
- Testifying expert
- Venue
- [NO COURT NAMED]
- Examination
- 2026-03-02 → 2026-03-06
- Issued
- 2026-03-11
- Version
- 1.0, supersedes none
The question asked
[SPECIMEN — NOT A REAL MATTER]
Instructed in writing, 2026-02-24:
Whether the nine Schedule A documents left the laptop issued to Custodian A for any removable device or non-corporate account between 2026-01-15 and 2026-02-20, and if so how and when.
Outside it: the content of those documents, the custodian's authority and, by nature, who was at the keyboard.
Material examined
[SPECIMEN — NOT A REAL MATTER]
| Item | Identifier | Digest (illustrative) | Does not establish |
|---|---|---|---|
| Laptop NVMe, acquired write-blocked 2026-02-26 | SPEC-0000-D1 | 5PEC1MEN5PEC1MEN5PEC1MEN5PEC1MEN5PEC1MEN5PEC1MEN5PEC1MEN5PEC0001 | That it was unaltered before it reached me. |
| Tenant audit log export, 2026-01-01–2026-02-20 | SPEC-0000-C1 | 5PEC1MEN5PEC1MEN5PEC1MEN5PEC1MEN5PEC1MEN5PEC1MEN5PEC1MEN5PEC0002 | That the log is complete. |
| File server, two directories collected | SPEC-0000-S1 | 5PEC1MEN5PEC1MEN5PEC1MEN5PEC1MEN5PEC1MEN5PEC1MEN5PEC1MEN5PEC0003 | That the rest of the server was examined. |
| Removable device at Finding 1 | not produced | — | Anything. It never reached me. |
Verified at acquisition and before production.
Method applied
[SPECIMEN — NOT A REAL MATTER]
Published procedure at /method: ISO/IEC 27037:2012 principles, NIST SP 800-86 phases. Guidance I work to, not accreditation I hold. The served version names every tool, version and discarded hypothesis: FRCP 26(a)(2)(B)(ii) reaches data considered, not only relied on.
Where a matter requires a certified examiner, an accredited laboratory or a licence, that is stated in the engagement letter and satisfied before work begins.
Findings
[SPECIMEN — NOT A REAL MATTER]
Four words, fixed: observed (in the artefacts), supported (independent classes agree), consistent with (not contradicted), not established.
| Finding | Basis | Confidence | Does not establish |
|---|---|---|---|
| 1. USB device SPECIMEN-USB-0001 connected twice, 2026-02-04T18:41:07-05:00 and 2026-02-05T07:12:22-05:00 | Registry, driver log and event log agree | Observed | Who connected it, or that a file was written to it. |
| 2. Seven of the nine filenames accessed from a volume with that identifier | Shortcut and recent-item artefacts, tested on a matching build (E-4) | Supported | That they were copied there; the artefacts record a filename, not content. |
| 3. One message to a non-tenant address, 2026-02-18T22:06:41-05:00, three attachments | Send record in the audit log | Observed | What the attachments held, or who composed it. |
| 4. Whether the other two documents left the laptop | Searched by filename, fragment and the classes above | Not established | That they did not leave; absence of a record is not evidence of absence. |
| 5. No wiping utility installed or run in the period | Application inventory, execution artefacts, journal | Supported | That nothing was deleted; retention and caches remove data with no intent. |
Intent to destroy evidence is the court's finding under FRCP 37(e)(2), not mine.
Exhibits, limitations
[SPECIMEN — NOT A REAL MATTER]
E-1 acquisition worksheets and manifest. E-2 chain of custody, authentication under FRE 901(a), not admissibility. E-3 timeline chart, an aid under FRE 107, not evidence. E-4 the test behind Finding 2. E-5 log summary, FRE 1006. E-6 certification, FRE 902(14).
Limitations
- Timestamps are as the source recorded them; disagreement is reported, not reconciled.
- The examination reaches what was collected, and nothing predates the earliest log entry.
- The removable device was not produced. No finding attributes anything to a person: a device is not a person.
- Recovery of deleted data depends on medium, filesystem and encryption; failed attempts are recorded, not omitted.
- If further material arrives, findings may change, and I will say so in writing.
Full list at /limits.
Statement of the examiner
[SPECIMEN — NOT A REAL MATTER]
I performed this examination and signed the report myself; the opinions are mine.
My compensation is the rate schedule in force at the engagement-letter date. It does not move with my findings, the outcome, or which side retained me.
I do not opine on who was at the keyboard, on intent, or on admissibility.
Left blank on purpose
[SPECIMEN — NOT A REAL MATTER]
- Qualifications, publications 10 yrs
- [BLANK]
- Testimony list, 4 yrs
- [BLANK]
- Compensation
- Rate schedule at the engagement-letter date
Where a matter requires a previously qualified testifying expert, that is named in the engagement letter; I bring one in or decline. Nothing on this site asserts a history of testimony, deposition or qualification.
In any report I produce, I will not
- Write to a conclusion supplied in advance.
- State a finding without its artefacts, or drop an inconvenient limit.
- Opine on who was at the keyboard from device evidence alone, or on intent.
- Promise a recovered file, an unlocked handset, or that anything will be admitted.
Ring me on 917-217-7975 and I will tell you whether this is even a forensics problem. If it is, you get the fee before I open anything.