Reporting Examination Results

Another helpful article from Forensic Magazine: "One of the more important facets of digital forensics concerns how to document the findings in a formal report. At first glance, this would seem to be rather straightforward: report what you found. Appearances, however, can be deceiving.

Since the “look and feel” of every report needs to be the same for every case, a standardized format is essential. Although not a legal document per se, reports do end up in court. Therefore, they need to be consistent in their format and grammatically correct. A poorly written report can have adverse effects regarding the testimony of the examiner and shed doubt upon the subsequent results of the examinations. After all, the report does reflect back upon the agency, the examiner, the methods of examination, and the results themselves.

To ensure that every examiner within an agency uses the same reporting format, a word processing template needs to be prepared and maintained (usually on a server or on local computers). Conversely, there are a number of in-house developed and commercially available evidence management applications that are programmed to generate reporting templates. If the agency has one of these applications, then that is probably the best method to use to generate templates and subsequent reports. Virtually all of these applications have the ability to insert standard text phrases (automatically and/or manually) into the body of the report, which can then be easily modified by the examiner or support staff ..."

Click here to continue reading this article.

Enjoy.