Notes from the work.

The 2024 accreditation rules set training and competency requirements for anyone performing manual facial comparison. What that means in practice for identity providers.

Synthetic identity documents have moved from novelty to operational problem. What examiners are seeing, and what current detection methods miss.

Most organisations discover their logging gaps during an incident. A short assessment beforehand changes what an investigation can establish.

Benches, workflow and extraction outlast three generations of instruments. Getting the facility right matters more than getting the kit right.

File timestamps and artefacts establish provenance, but routine IT activity destroys them. What to preserve, and when.

Documents, digital data, imagery and identity are usually examined separately. The connections between them are where most investigations turn.