Reporting
Tip 5: Develop a thorough reporting format that emphasizes key findings
Having finished recovering and analyzing artifacts, you’ll need to pull together a report detailing the evidence analyzed
and explaining your process and findings. Although formats may vary slightly case-by-case, creating a template for
presenting reports will establish consistency and allow courts to grasp the contents of reports more easily over time.
Here are a few helpful general considerations on report-writing
from forensic consultant Melia Kelly.
Include an executive summary detailing your results.
This section should also give context to the evidence
analyzed.
List every piece of evidence analyzed, including serial
numbers, hash values, photographs, etc.
Write thorough descriptions for photographs, including
information on the camera type, date, timestamps and
locations.
Clearly show the steps taken to collect and analyze
artifacts, including listing any software or hardware used to
extract and analyze data.
Create a timeline. It’s helpful to create a visual that
demonstrates the chronological sequence of events in a way that’s easy for readers to grasp.
Remember to put yourself in the shoes of the reader. What questions might you have about the evidence
if you were in their position? If you can adequately answer these questions in your report, you may be released
from testifying.
Magnet Forensics - 8 Tips for Presenting Digital Evidence in Court - 5