Before preparing a report, make sure that your client wants a report prepared. Not every client wants written documentation of an investigation. Federal Rules of Civil Procedures used to require disclosure of all draft reports prepared by expert witnesses along with all communications between attorneys and their expert witnesses. In some jurisdictions, attorneys may still be required to produce copies of draft reports, along with e-mails between the attorney and forensic expert, as a part of the court record. Such documentation could include information that the client does not wish to make public or be generally known. For this reason, some clients avoid reports.
The Federal Rules of Civil Procedure were amended on December 1, 2010. (See the discussion of Rule 26(b)(4)(B) and Rule 26(b)(4)(C) in “Document Everything, Assume Nothing,” earlier in this chapter.) Under the new rules, greater protection from disclosure is now provided to draft reports prepared by expert witnesses as well as attorney-expert witness communications. As of the writing of this book, it’s too early to fully understand how these new rules will work in the real world for expert forensic witnesses.
As noted in “Tales from the Trenches: Reports,” earlier in this chapter, if you do prepare a report, you might have to use it to recall events years after the fact. Therefore, reports should contain focused and specific information. Each forensic investigator has his or her own way to formulate reports, but establishing a standardized template is important. This way, your work will be consistent. The more you use a template, the more proficient you will become. You also want the items you refer to in your report to be consistent so you don’t confuse your audience. For example, if you discuss a “hard drive” in your report, be sure that all instances refer to it as just that. Using the terms “hard disk,” “hard drive,” and “fixed disk” interchangeably in the same report can cause confusion for its readers. It’s a good idea to define terms in the report to avoid future confusion. For example, you might define “hard drive” in reports by saying: “We located a 120 GB, Western Digital Hard Drive, s/n 123456–789012 (hereafter referred to as ‘Hard Drive’).” In fact, including a glossary can help define items listed in your report. Here are some items the report should contain:
- Name of the reporting agency and case investigator
- Case number
- Date of the report
- Numbered pages (e.g., Page 3 of 12)
- List of the items examined
- Description of the examination process
- Results and/or conclusion
A typical report format consists of several independent sections, which include the preceding information. These sections are presented in the following order:
Executive Summary or Summary of Findings The summary is a brief explanation of the circumstances that required the investigation and a short detail of the significant findings. Include the names of all persons involved in the case and the date.
Objectives This section states the specific purpose for the investigation—for example, to determine if a subject used a laptop computer as an instrument in the crime of identity theft and/or as a repository of data related to that crime. Include the name of the reporting agency and investigator.
Analysis This section provides a description of the evidence and the steps taken to process that evidence.
Findings The findings include specific information listed in order of importance or relevance. This can include data and graphic image analysis, Internet-related evidence, and techniques used to hide data.
Supporting Documentation This section includes how you arrived at the findings in the previous section. The supporting documentation is usually the longest section of the report. It can also contain the printouts of items of evidence and chain of custody documentation. To authenticate printout pages as a part of the report information, the forensic investigator preparing the report should initial and date each page in the bottom corner.
Glossary This section can be included to help the reader understand technical terms contained in the report.
Now that you have some idea of the format the report should have, let’s look at a few sample reports.