Technical investigation
Structured examination of incidents, records, scenes and hypotheses.
The proposal and report should distinguish what was examined, what was unavailable and what falls outside the engagement.
The exact activities depend on competence, authority, safety and the material available.
Structured examination of incidents, records, scenes and hypotheses.
Preservation guidance, inventories, chronology, metadata and integrity controls.
Technical notes, reports, questions, limitations and review of supplied material.
These boundaries remain applicable even when technology or AI-assisted tools are used.
GIFO does not compel testimony, seize material, access systems without authority or replace public authorities.
Technical support does not determine legal strategy, admissibility or the final legal effect of evidence.
A score, model output, metadata item or hash is not by itself proof of manipulation, authorship or truth.
Insufficient, altered or unavailable material may prevent a reliable answer.