# Digital forensic case worksheet

Blank educational template. Keep completed case material in your case storage.

## Scope
- Case identifier / examiner:
- Question to answer:
- Authorized source, account/profile, date range:
- Exclusions and collection constraints:

## Collection
- Evidence identifier / source device:
- Model / OS build / app version:
- Observed device state:
- Acquisition method / tool / version:
- Acquisition start / end / timezone:
- Warnings, failed paths, unavailable profiles:
- Original container / segments / byte sizes:
- SHA-256 digest or multi-file manifest location:
- Acquisition verification result:
- Master storage / working copy / transfer record:

## Examination
- Tool versions / modules / settings:
- Source locator (file, table, row, event record):
- Direct observation:
- Raw timestamp / epoch / unit / source offset:
- UTC conversion / clock uncertainty:
- Independent corroboration:
- Alternative explanations tested:
- Missing evidence and limits:

## Finding
- Answer supported by the available evidence:
- Interpretation distinguished from observation:
- Unanswered questions:
- Reviewer / reproducibility check:
- Response changes and their timestamps: