Chapter 9

Pulling It All Together

• Creating proper and thorough documentation
• Formulating a concise analysis report summary
• Exploring model analysis reports and sample reports
• Using software to create reports

Throughout the forensic process, an investigator extracts and examines mounds of information. In the end, all this information must be processed into a succinct report that is understandable to a judge and a jury.

Your top priority is to properly document all steps taken during the evidence-gathering process. Good documentation, along with sound forensic procedures, is essential for successful prosecution of criminal cases. Crucial evidence is subject to question, and qualifications of any expert witness can become an issue if computer evidence is not documented systematically. (Before you’re allowed to provide expert opinions, you must first be qualified as an expert in computer forensics. Qualifications of an expert witness can be challenged at any time, even when evidence has been gathered and documented properly.) This is what makes the ability to accurately reconstruct and recite the details of an investigation such a critical skill.

In this chapter we’ll look at the information you might need and how to put all the pieces together in an analysis report that is concise yet detailed enough to explain your findings. This chapter examines the process of documenting evidence gathering and works through several sample reports to “show and tell” the type and quality of documentation you will need for a case.