The advancement of information technology (IT) has significantly impacted forensic science, necessitating the development of standardised methods within computer forensics to improve investigation quality and reliability. This paper aims to address the challenges faced in forensic information technology examinations by proposing a structured framework for categorising expert activities and formulating guiding questions for forensic experts. Employing a detailed analysis of current practices and identifying common pitfalls, this study introduces a two-dimensional classification of forensic expert activities into direct, indirect, and elementary and complex tasks. This categorisation facilitates a nuanced understanding of expert roles and the intricate nature of forensic investigations. The paper outlines key activity categories, including professional interpretation, compliance testing, digital evidence acquisition and management, laboratory examinations, and evidence presentation. The findings suggest that employing standardised methods and specific guiding forensic tasks or assignments that competent authorities can utilise can significantly enhance forensic investigations’ consistency, efficiency, and effectiveness. Ultimately, the paper concludes that the proposed solutions offer a promising approach to improving the practice of forensic information technology expertise, thereby supporting the pursuit of justice in the digital age.