Incident Response & Computer Forensics, 2nd Ed., 2nd Edition

CHAPTER 17

Writing Computer Forensic Reports

 

A great investigation can be rendered largely ineffective if the resulting documentation is subpar. A forensic report should document facts and/or offer opinions with a style of communication that provides decision-makers with useful, accurate information. If decision-makers cannot understand your report, are not provided the files or file fragments that are the foundation of your conclusions, or cannot easily reference your documentation, that report cannot advance your case. In fact, a report that is disorganized and poorly written may actually hinder the advancement of your case.

This chapter outlines some general guidelines that every computer forensic report should adhere to. We also provide ...