science investigationchain of custodydigital forensicsencase ftkincident response
Complete evaluation framework
What to assess and how to score it
Review the evidence signals before interviewing. Then use the anchored descriptions—not instinct alone—to choose the score that best matches each answer.
01
Evaluation factor
Method and rigour
35% weight
Check command of forensically sound acquisition: write blockers, hashing with MD5/SHA-256, chain of custody logs, imaging in E01 versus dd, and validation of EnCase, Axiom or FTK output.
Evidence to listen for
Follows and can justify an established methodology
Understands contamination, bias, and chain of custody as they apply to the field
Knows the limits of their techniques and says so
Documents procedure so results are reproducible and defensible
Five-point scoring guide
1
Poor
Careless method; unaware of contamination, bias, or procedural integrity.
2
Needs Improvement
Knows procedures but applies them inconsistently; gaps in documentation.
3
Satisfactory
Sound standard practice; less certain outside familiar techniques.
4
Very Good
Rigorous and well documented; understands the limits of each method.
5
Excellent
Names verification steps at each stage, explains hash mismatch handling, and treats custody documentation as evidence rather than paperwork.
02
Evaluation factor
Real casework
25% weight
Probe actual case volume and type: insider data theft, BEC, ransomware timelines, mobile extractions via Cellebrite or GrayKey, and how many exhibits they personally processed.
Evidence to listen for
Brings specific cases, sites, or projects rather than general description
States their own role and what they personally handled
Can describe an ambiguous or degraded case and how they proceeded
Knows what happened to the work afterwards
Five-point scoring guide
1
Poor
No hands-on casework; experience is entirely academic.
2
Needs Improvement
Limited exposure; cannot describe their own contribution clearly.
3
Satisfactory
Real casework with adequate detail; ownership sometimes vague.
4
Very Good
Specific cases with clear personal scope and outcomes.
5
Excellent
Describes specific cases with artefact detail (shellbags, USN journal, Volume Shadow Copies) and their own role in each, not the team's.
03
Evaluation factor
Interpretation and judgement
25% weight
Test reasoning from artefacts to conclusions: registry and prefetch interpretation, anti-forensics or timestomping detection, and how they weigh gaps or contradictory timeline evidence.
Evidence to listen for
Separates what the evidence shows from what they infer
States confidence levels and what would change their conclusion
Comfortable saying the result is inconclusive
Handles pressure to reach a preferred conclusion without bending
Five-point scoring guide
1
Poor
Overstates findings; no separation of evidence from inference.
2
Needs Improvement
Reaches conclusions the evidence does not support; uneasy with uncertainty.
3
Satisfactory
Reasonable judgement; qualifies findings when prompted.
4
Very Good
Clearly separates evidence from inference and states confidence unprompted.
5
Excellent
Distinguishes what the artefacts prove from what they suggest, states confidence levels, and has withdrawn or revised a conclusion when evidence changed.
04
Evaluation factor
Reporting and testimony
15% weight
Assess written and courtroom output: exhibit reports, expert witness or deposition experience, disclosure obligations, and how they explain hash values or link file parsing to counsel.
Evidence to listen for
Writes findings that a non-specialist can act on
Has presented or defended work to an external audience: court, client, review board, publication
Withstands challenge without overclaiming or retreating
Keeps records that hold up to scrutiny
Five-point scoring guide
1
Poor
Cannot communicate findings; records would not withstand review.
2
Needs Improvement
Reporting is unclear or incomplete; avoids external scrutiny.
3
Satisfactory
Adequate reports; limited experience defending work externally.
4
Very Good
Clear reporting and real experience presenting to an external audience.
5
Excellent
Produces reports that survive opposing review, and recounts cross-examination or client challenge without overstating findings.
Put this rubric to work
Score every candidate against the same standard
Add these weighted factors to Hirevire and let AI evaluate recorded answers against your rubric.
