Guide to Computer Forensics and Investigations Fourth Edition, Study notes of Forensics

Download Guide to Computer Forensics and Investigations Fourth Edition and more Study notes Forensics in PDF only on Docsity!

Guide to Computer Forensics

and Investigations

Fourth Edition

Chapter 14

Report Writing for High-Tech

Investigations

Objectives

• Explain the importance of reports
• Describe guidelines for writing reports
• Explain how to use forensics tools to generate

reports

Limiting a Report to Specifics

• All reports to clients should start with the job

mission or goal

• Find information on a specific subject
• Recover certain significant documents
• Recover certain types of files
• Before you begin writing, identify your audience

and the purpose of the report

Types of Reports

• Computer forensics examiners are required to

create different types of reports

• Examination plan
  • What questions to expect when testifying
  • Attorney uses the examination plan to guide you in your testimony
  • You can propose changes to clarify or define information
  • Helps your attorney learn the terms and functions used in computer forensics

Types of Reports (continued)

• Verbal report
  • Less structured
  • Attorneys cannot be forced to release verbal reports
  • Preliminary report
  • Addresses areas of investigation yet to be completed
    • Tests that have not been concluded
    • Interrogatories
    • Document production
    • Depositions

Types of Reports (continued)

• Written report
  • Affidavit or declaration
  • Limit what you write and pay attention to details
    • Include thorough documentation and support of what you write

Guidelines for Writing Reports

(continued)

• As an expert witness, you may testify to an opinion,

or conclusion, if four basic conditions are met:

• Opinion, inferences, or conclusions depend on special knowledge or skills
• Expert should qualify as a true expert
• Expert must testify to a certain degree of certainty
• Experts must describe facts on which their opinions are based, or they must testify to a hypothetical question

What to Include in Written Preliminary

Reports

• Anything you write down as part of your

examination for a report

• Subject to discovery from the opposing attorney
• Considered high-risk documents
• Spoliation
• Destroying the report could be considered destroying or concealing evidence
• Include the same information as in verbal reports

Report Structure

• Structure
  • Abstract
  • Table of contents
  • Body of report
  • Conclusion
  • References
  • Glossary
  • Acknowledgements
  • Appendixes

Writing Reports Clearly

• Consider
  • Communicative quality
  • Ideas and organization
  • Grammar and vocabulary
  • Punctuation and spelling
• Lay out ideas in logical order
• Build arguments piece by piece
• Group related ideas and sentences into paragraphs
  • Group paragraphs into sections

Writing Reports Clearly (continued)

• Include signposts
  • Draw reader’s attention to a point

Designing the Layout and Presentation

of Reports

• Decimal numbering structure
  • Divides material into sections
  • Readers can scan heading
  • Readers see how parts relate to each other
• Legal-sequential numbering
  • Used in pleadings
  • Roman numerals represent major aspects
  • Arabic numbers are supporting information

Designing the Layout and Presentation

of Reports (continued)

• Including calculations
  • If you use any hashing algorithms, be sure to give the common name
• Providing for uncertainty and error analysis
  • Protect your credibility
• Explaining results and conclusions
  • Explain your findings, using subheadings to divide the discussion into logical parts
  • Save broader generalizations and summaries for the report’s conclusion

Designing the Layout and Presentation

of Reports (continued)

• Providing references
  • Cite references by author’s last name and year of publication
  • Follow a standard format
• Including appendixes
  • You can include appendixes containing material such as raw data, figures not used in the body of the report, and anticipated exhibits
  • Arrange them in the order referred to in the report