This article is a written companion to the conference presentation of the same name. The full deck and CLE-accredited version are available on request.
Fifteen years of forensic and eDiscovery work, across hundreds of matters, surface the same pattern: cases don't usually turn on the dramatic forensic finding. They turn on a series of small, recoverable decisions made early — decisions about scope, preservation, methodology, and documentation.
The 25 lessons below are organized into four phases. They are not exhaustive. They are the patterns that recur most often when a case goes well — and the patterns that recur most often when one doesn't.
Phase 1 — Before the engagement
01 · Define the question presented
Forensic work is only as useful as the question it's answering. The engagement letter should state the question in plain language: Was this file accessed after termination? Was this device used to send these messages? Was this account accessed from outside the United States? Without a stated question, the report has no shape.
02 · Confirm the legal authority before touching the data
Court order, consent, preservation hold, employer custodian agreement, or subpoena. The basis matters. A perfect forensic acquisition with no legal authority underneath it is unusable.
03 · Identify the right examiner
The examiner's qualifications travel with the report. If the matter is likely to reach trial or arbitration, that question should be answered before the work starts, not after a Daubert motion is filed.
04 · Establish chain of custody from minute zero
The custody log starts the moment the evidence is identified, not the moment it's imaged. Who had access. Where it was stored. When it was sealed. Gaps in custody are the most common reason evidence is excluded.
The most common reason a forensic finding fails on the stand is not that the analysis was wrong. It's that the chain of custody can't be reconstructed. That's a documentation problem, not a technical one.
Phase 2 — During acquisition
05 · Validate the tool before you use it
Every forensic tool has a known set of limitations. Encrypted iOS backups, locked Androids, certain SQLite write-ahead logs. The examiner should know — and the report should disclose — what the tool cannot do, before opposing counsel raises it.
06 · Image the device, don't work the device
Original media is sealed. All work is performed against a verified forensic image. Hash values recorded at acquisition and verified at every subsequent step.
07 · Acquire the cloud, not just the device
Modern phones are partial views of accounts that live in the cloud. iCloud, Google, Microsoft 365, WhatsApp backups, Dropbox. If the question presented can be answered by cloud data, the cloud is in scope.
08 · Document the decision log
Every choice an examiner makes is a choice opposing counsel can ask about. What was searched. What was excluded. Why. The decision log is the document that turns those questions into routine cross-examination instead of cross-examination that goes somewhere uncomfortable.
Phase 3 — During analysis
09 · Test the hypothesis from both sides
Good forensic work runs the analysis assuming the opposite of the desired finding. If the conclusion still holds, the report is stronger. If it doesn't, the examiner has time to revise before the report is delivered.
10 · Treat deleted data with appropriate skepticism
Deleted file recovery is a probabilistic exercise. The report should say what was recovered, the confidence level, and what limits the conclusion. Overclaiming on deleted data is one of the fastest ways to lose credibility.
11 · Pin findings to artifacts
Every claim in the report should reference the underlying artifact — file path, hash, database table, timestamp source. A report that says "the user accessed the file" without citing the artifact behind that statement is a report that won't survive cross.
12 · Treat timestamps as evidence, not facts
Timestamps lie. Time zones shift. Devices sync. The same artifact can carry created, modified, accessed, MFT entry, last-opened, and platform-recorded timestamps — and they often disagree. The report should state which timestamp it's relying on and why.
Phase 4 — Reporting and testimony
13 · Write the report for the trier of fact
The report is read by judges, juries, and arbitrators — not by other forensic examiners. The methodology section should be technical enough for a peer to reproduce. Everything else should be readable by counsel without a tutorial.
14 · State qualifications before they're raised
The examiner's qualifications, training, certifications, and prior testimony should be in an appendix to the report. Not in a separate document produced under subpoena later.
15 · Disclose limitations
What the analysis could not establish, what was outside scope, what the tool could not access. Limitations disclosed in the report are limitations opposing counsel cannot make into a moment on the stand.
16 · The TRACE™ standard
LTD's signature deliverable — the TRACE™ Report — is built to this framework. Scope, authority, methodology, tooling, findings, conclusions, qualifications, reproducibility statement. Each section exists because the absence of it has lost a case somewhere.
The remaining nine lessons cover deposition prep, expert disclosure timing, Daubert briefing posture, exhibit prep, demonstratives, working with opposing experts, the role of the consulting (vs testifying) expert, settlement leverage from forensic findings, and post-trial preservation. The full CLE-accredited version of the talk is available through LTD's CLE program.
Closing
A forensic engagement that ends well looks boring. The chain of custody is intact. The methodology is documented. The findings are pinned to artifacts. The conclusions are tied to the question presented. There is no drama in any of it. That's the goal. The drama belongs in the courtroom, not in the methodology.
Carlos Baradat is the founder of Legal Tech Dynamics — a technology consulting practice focused on digital forensics, eDiscovery, and AI governance. He is a Florida-licensed attorney and serves on the Florida Bar Special Committee on Artificial Intelligence. His book AI for Legal Practice (The Virtual Jurist Press) is forthcoming 2026.