Structure of a Digital Forensics Expert Report: The Format and Sections Courts Accept

A digital forensics expert report is the document where digital evidence comes to life before the court. No matter how strong the image, hash value, log record or WhatsApp backup in the file may be, the judge reads that evidence through the report. If the report's structure is broken, even a technical miracle in its content cannot save the outcome. In this guide we bring together, in a single format, the framework drawn by the Code of Civil Procedure (HMK) and the Code of Criminal Procedure (CMK), the sections required by international standards (ISO/IEC 27037, NIST SP 800-86, SWGDE), and the rejection patterns that recur in Court of Cassation decisions.

For the related pillar article, see: Digital Forensics: A Guide to Digital Evidence in Türkiye. For case-specific topics: The evidentiary value of WhatsApp, Digital evidence in divorce, Spyware detection, KVKK breach complaint. Service page: Ankara digital forensics.

Who Is a Court-Appointed Expert, Who Is a Party Expert? The Distinction Between HMK and CMK

Articles 266 to 287 of the Code of Civil Procedure (HMK) govern the role of the court-appointed expert (bilirkişi). When the resolution of a matter requires special and technical knowledge, the court turns to an expert (HMK 266). The court-appointed expert is appointed by the court, the scope of the assignment is recorded in the file, and the oath text is entered into the file. HMK 293 governs the "expert opinion" (uzman görüşü) that the parties obtain through their own means; this opinion is not a court-appointed expert report, it has the character of party evidence, and while it does not bind the judge, it is taken into consideration.

Articles 62 to 73 of the Code of Criminal Procedure (CMK) govern the role of the court-appointed expert, while the final paragraph of Article 67, together with Articles 67/6 and 68, governs the party expert opinion (uzman mütalaası). In criminal proceedings, the party expert opinion is a written or oral opinion the defendant or the participant obtains from an expert of their own choosing; it enters the file in addition to the court-appointed expert report. The difference is not formal, its effect is what differs: the court-appointed expert report is a direct instrument for evaluating evidence, whereas the party expert opinion is a weapon for challenging that report.

The Department of Expert Witnessing (https://bilirkisilik.adalet.gov.tr) publishes the list of areas of expertise and the ethical principles each year; under the core subfield of "Information Technologies" there is a "Digital Forensic Examination" specialization. The name the court selects from the list prepares the report, while an expert not on the list can prepare an expert opinion on behalf of a party.

For the legislative texts: full text of the HMK (https://www.mevzuat.gov.tr/MevzuatMetin/1.5.6100.pdf), full text of the CMK (https://www.mevzuat.gov.tr/mevzuatmetin/1.5.5271.pdf).

The 9 Mandatory Sections of the Report

The structure below is a combination of HMK 279, CMK 67, the Department of Expert Witnessing template, ISO/IEC 27037 (https://www.iso.org/standard/44381.html) and NIST SP 800-86 (https://csrc.nist.gov/pubs/sp/800/86/final) recommendations, adapted to Turkish practice.

1. Header and File Identification

The first page is the report's identity card. It must contain: the name of the court, the file's principal case number (only the case number, not the parties), the report date, the report number (the expert's own registry number), the names and titles of the parties (plaintiff, defendant, accused, participant), the expert's full name, registry number, area of expertise, and contact information. In a single line it should state "report submitted to the file" along with the page count. A report with no case number or with the parties written incorrectly bounces back with an objection on UYAP before it is ever opened.

2. Appointment and Scope of the Assignment

This states at which hearing and by which dated interim decision the court appointed the expert, on which date the file was delivered to the expert, and, if additional time was requested, on which date it was granted. This section is directly tied to HMK 273 (time limits) and CMK 66 (appointment). If the report deadline is missed, the expert's fee can be reduced; in cases of severe delay, the appointment can be revoked. The scope of the assignment must be quoted verbatim; if the expert answers a question not included in the assignment, the report is rejected on the grounds of "exceeding the limits of the assignment."

3. Subject of Examination and Questions Posed

The questions in the court's interim decision must be listed exactly as written. They are numbered as Question 1, Question 2, and the answers at the end of the report match these numbers. There should be no added commentary or omitted word. One of the rejection patterns that recurs across decisions of various chambers of the Court of Cassation is the expert answering the topics they personally consider important rather than the questions actually posed.

4. Methodology and Standards Applied

This is the section that distinguishes a digital forensics report from an ordinary technical report. The following items are stated clearly:

• The imaging method (bit-by-bit copy, logical copy, live system image).
• The hardware used (write blocker make and model, imaging device serial number).
• The software used and its version (FTK Imager, X-Ways, Autopsy, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic; with the version number included).
• The hash algorithm (MD5 and SHA-256 are given together; MD5 alone is now considered insufficient).
• The working environment (climate-controlled laboratory, network-isolated workstation).
• The reference standard: ISO/IEC 27037 (identification, collection, acquisition and preservation of evidence), NIST SP 800-86 (integration process), SWGDE (https://www.swgde.org) best-practice notes.

A report with no methodology stated is open to challenge because "the methodology by which this conclusion was reached cannot be audited." This is a return ground frequently seen in the case law of the 12th Civil Chamber and the 8th Criminal Chamber of the Court of Cassation; decisions can be searched at https://karararama.yargitay.gov.tr.

5. Chain of Custody

A table records by whom, on which date and with which record the device was received, whose hands it passed through, and under what conditions it was stored. The table contains these columns: date and time, action, responsible person, signature status, hash check. ISO/IEC 27037 requires that this chain never be broken and that a verifiable record be kept at every stage.

The device intake record contains the device serial number, IMEI, make and model, and physical condition (scratches, cracks, signs of being opened). If there is a seal number, it is noted. If the seal was broken, a photograph of the moment it was opened is attached. If a signature is missing from even one link of the chain, the integrity of the evidence becomes disputable.

6. Technical Findings

This is the longest section and the one that must be the most disciplined. Here the expert writes only "what they observed," not "what it means." Interpretation belongs to the next section. Findings are presented under these subheadings:

• Device technical details (model, operating system, version, IMEI, last boot date).
• Disk structure, partitions, file system.
• Categories of extracted files (messaging, call logs, photos, videos, location, application databases).
• Deleted and recoverable data (carving results).
• Timestamps (UTC and local time together).
• Database query outputs (for example, WhatsApp msgstore.db queries).
• Screenshots and the order in which they appear in the report.

Each finding is presented in a table or numbered list, and the finding number does not change through to the end of the report. No subjective adjectives are used; words such as "suspicious," "deliberate" or "forged" do not appear in this section. A finding is "raw data."

7. Interpretation, Evaluation and Conclusion

In this section the expert matches each finding to the question posed. A sentence like "When finding B-7 relating to Question 3 is examined" is typical. Interpretation is a technical inference, not a legal characterization. One does not say "a crime has been committed" or "the tortious act is established"; those belong to the judge's domain. The correct sentence is: "The findings indicate that data X was sent from device Z on date Y; the legal characterization is at the court's discretion."

The conclusion is written as a separate paragraph for each question posed. Where there is uncertainty, it is stated plainly: "It could not be answered with the available data," "A definitive conclusion cannot be reached without physical access to the device." Courts return reports that try to appear definitive but rest on weak grounds.

8. Annexes

The order of the annexes follows the order in which they are cited in the report. Typical annexes:

• A copy of the appointment letter.
• The intake record.
• Hash check outputs (during and after imaging).
• Screenshots (each numbered, captioned, with a date and time stamp).
• Database outputs (CSV or PDF).
• A screenshot of the software license and version used.
• The expert's oath text (CMK 64, HMK 271).
• A copy of the expert's registry certificate.

Each annex is page-numbered and cross-referenced with the main body of the report. If the text says "as can be seen in Annex 4" but the annex is missing, the report loses its credibility.

9. Signature and Oath Declaration

On the final page the oath declaration is repeated: in accordance with HMK 271 and CMK 64, "I swear upon my honor, my dignity, and all the beliefs and values I hold sacred that I will carry out my duty with loyalty and care; that, adhering to scientific and technical principles, I will remain impartial and refrain from expressing any opinion contrary to the truth." The expert's name, registry number, signature, and the date the report was drawn up are included. If there is more than one expert, each one signs separately; a joint signature is invalid.

The 7 Most Common Mistakes

The patterns that recur in Court of Cassation decisions and in expert ethics violations are gathered in the list below. These mistakes directly cause a report to be rejected or a supplementary report to be requested.

1. Subjective findings: Expressions such as "the suspect probably" or "most likely deliberate." An expert does not attribute probability; they give a ratio, or where there is no data they say "data insufficient."
2. Missing hash: Providing only the hash from the moment of imaging and omitting the post-examination verification hash. Or giving only MD5 and skipping SHA-256.
3. Failing to state the methodology: Saying "the device was examined" without writing which tool, which version, which standard was used. A report without a methodology cannot be audited.
4. Legal interpretation: Characterizations such as "a crime has been committed," "is at fault," or "is slander." Legal characterization belongs to the judge.
5. Lack of photographs and screenshots: A finding described in text but not supported by an image. SWGDE best-practice notes treat visual evidence as essential.
6. Failing to cite sources: Not referencing the standard, article or technical documentation used. The source of the expert's knowledge must be auditable.
7. Lack of accurate timestamps: Writing only local time without providing UTC, or accepting a timestamp as correct without checking the device's clock setting. When the device clock is off, the entire timeline comes out wrong.

Recurring Rejection Grounds in Court of Cassation Decisions

In searches conducted through the Court of Cassation decision search (https://karararama.yargitay.gov.tr) using the keywords "expert report," "digital forensics," "imaging" and "chain of custody," the following patterns stand out:

• Exceeding the scope of the assignment: The expert answering a question not asked or making a legal characterization.
• Methodological ambiguity: Failing to write which software version and which standard was applied.
• A broken hash chain: Failing to perform a hash comparison between imaging and the end of the examination.
• Insufficiency with a single expert: When a multidisciplinary case (for example, both a mobile device and a server log) is assigned to a single expert, a supplementary report is requested for the area left uncovered.
• Conflicting reports: When there are multiple reports in the same file, the file is referred to the Council of Forensic Medicine or a third panel of experts to resolve the conflict.

An expert who knows these patterns writes a resilient report from the outset; one who does not prolongs the file through rounds of supplementary reports.

The Practical Meaning of ISO/IEC 27037, NIST SP 800-86 and SWGDE

Turkish courts do not apply international standards directly, but a report's credibility increases if it references these standards. ISO/IEC 27037 provides a conceptual framework for the identification, collection, acquisition and preservation of digital evidence. NIST SP 800-86 provides phase definitions for the integrated digital forensics process: collection, examination, analysis, reporting. SWGDE best-practice notes provide applied checklists for specific device types (mobile, cloud, IoT).

When a report contains references such as "in accordance with ISO/IEC 27037 clause 5.4, the acquisition order was recorded," the objecting party's claim that "the methodology is ambiguous" is weakened.

Time Limits and Practical Notes

HMK 273 governs the time granted to the expert; the court generally grants three months and extends it upon a reasoned request. CMK 66/3 provides for reassessment of expert assignments exceeding three months in criminal files. A fee-reduction sanction applies to reports not submitted on time. In civil files, under HMK 274 the expert must immediately report any excuse; an unexcused delay gives rise to disciplinary liability.

The report is uploaded to UYAP as a PDF; the annexes can be uploaded combined into a single file or as a supplementary document type. The physical device is returned by record. Image copies are kept by the expert for at least the minimum retention period. The Department of Expert Witnessing ethical principles recommend that image copies be preserved until the case becomes final, and that a secure destruction record be drawn up after finalization.

On the matter of fees, the expert cannot receive payment directly from a party beyond the fee assessed by the court. An expert opinion prepared on behalf of a party, on the other hand, rests on a contractual relationship and is documented by invoice; this opinion is submitted to the court through the party's attorney.

Objecting to the Expert Report and Supplementary Reports

After the report is submitted to the court, it is served on the parties. HMK 281 governs the objection mechanism in civil proceedings, and CMK 67 in criminal proceedings. The parties can file an objection petition within two weeks, setting out the points they find missing or contradictory. If the court finds the objection justified, it requests a supplementary report or appoints a new expert.

A party expert opinion is the most effective tool for strengthening an objection petition. The opposing party's expert documents, in technical terms, the methodological error, hash deficiency or interpretive drift of the court's expert. For this reason, in serious digital forensics cases, the parties place their own expert opinion in the file rather than relying on the court alone.

For conflicting reports, the court can turn to a third panel of experts or refer the matter to the Cybercrime Specialization Department of the Council of Forensic Medicine. This process prolongs the file; for this reason, preparing the first report flawlessly is a saving for both sides.

Closing

A good digital forensics expert report consists of three elements: fidelity to the legal framework (HMK, CMK), alignment with international technical standards (ISO/IEC 27037, NIST SP 800-86, SWGDE), and disciplined writing (separating findings from interpretation, citing sources, timestamp integrity). If these three legs are sound, the report survives in court; if even one is missing, even the strongest technical finding loses its effect.

A Court-Ready Expert Report in Ankara

DSET Digital Forensics operates from its base at Hacettepe Teknokent in Ankara. Founder Hamza Aytaç Doğanay served for 6 years in the Cybercrime Unit of the General Directorate of Security and completed his thesis-based master's degree at Ankara University. For court-appointed expert work and the preparation of party expert opinions, contact: +90 536 662 38 09. All reports are delivered aligned with the 9-section structure described in this article, the HMK and CMK framework, and international standards. DSET, since 2003, Ankara Hacettepe Teknokent Beytepe; +90 536 662 38 09.