science investigationchain of custodydigital forensicsencase ftkincident response
Complete evaluation framework
What to assess and how to score it
Review the evidence signals before interviewing. Then use the anchored descriptions—not instinct alone—to choose the score that best matches each answer.
01
Evaluation factor
Method and rigour
35% weight
Check command of forensically sound acquisition: write blockers, hashing with MD5 or SHA256, imaging in EnCase, FTK Imager or dd, plus volatile memory capture and chain of custody logs.
Evidence to listen for
Follows and can justify an established methodology
Understands contamination, bias, and chain of custody as they apply to the field
Knows the limits of their techniques and says so
Documents procedure so results are reproducible and defensible
Five-point scoring guide
1
Poor
Careless method; unaware of contamination, bias, or procedural integrity.
2
Needs Improvement
Knows procedures but applies them inconsistently; gaps in documentation.
3
Satisfactory
Sound standard practice; less certain outside familiar techniques.
4
Very Good
Rigorous and well documented; understands the limits of each method.
5
Excellent
Describes verified imaging workflows, hash validation at each transfer, and defensible custody documentation that survived defence or opposing counsel scrutiny.
02
Evaluation factor
Real casework
25% weight
Probe actual matters worked: mobile extractions in Cellebrite or GrayKey, ransomware timelines, insider data exfiltration, or fraud cases, with volumes, device types and turnaround times.
Evidence to listen for
Brings specific cases, sites, or projects rather than general description
States their own role and what they personally handled
Can describe an ambiguous or degraded case and how they proceeded
Knows what happened to the work afterwards
Five-point scoring guide
1
Poor
No hands-on casework; experience is entirely academic.
2
Needs Improvement
Limited exposure; cannot describe their own contribution clearly.
3
Satisfactory
Real casework with adequate detail; ownership sometimes vague.
4
Very Good
Specific cases with clear personal scope and outcomes.
5
Excellent
Names specific case types and evidence volumes, including encrypted devices, cloud accounts and mobile handsets processed to conclusion under deadline.
03
Evaluation factor
Interpretation and judgement
25% weight
Test how they read artefacts: registry hives, $MFT and USN journal, shellbags, browser and LNK data, distinguishing user action from automated process, and stating confidence limits.
Evidence to listen for
Separates what the evidence shows from what they infer
States confidence levels and what would change their conclusion
Comfortable saying the result is inconclusive
Handles pressure to reach a preferred conclusion without bending
Five-point scoring guide
1
Poor
Overstates findings; no separation of evidence from inference.
2
Needs Improvement
Reaches conclusions the evidence does not support; uneasy with uncertainty.
3
Satisfactory
Reasonable judgement; qualifies findings when prompted.
4
Very Good
Clearly separates evidence from inference and states confidence unprompted.
5
Excellent
Builds timelines from multiple corroborating artefacts, flags anti-forensics or gaps openly, and refuses to overstate what the evidence supports.
04
Evaluation factor
Reporting and testimony
15% weight
Assess report writing and courtroom exposure: expert statements, Daubert or ACPO principles, peer review of findings, and holding up under cross examination or client technical challenge.
Evidence to listen for
Writes findings that a non-specialist can act on
Has presented or defended work to an external audience: court, client, review board, publication
Withstands challenge without overclaiming or retreating
Keeps records that hold up to scrutiny
Five-point scoring guide
1
Poor
Cannot communicate findings; records would not withstand review.
2
Needs Improvement
Reporting is unclear or incomplete; avoids external scrutiny.
3
Satisfactory
Adequate reports; limited experience defending work externally.
4
Very Good
Clear reporting and real experience presenting to an external audience.
5
Excellent
Has testified or produced disclosed reports, explains hash verification and artefact meaning in plain language, and cites review processes used.
Put this rubric to work
Score every candidate against the same standard
Add these weighted factors to Hirevire and let AI evaluate recorded answers against your rubric.
