Guide to Computer Forensics and Investigations, Fifth Edition 14-1
Chapter 14
Report Writing for High-Tech Investigations
At a Glance
Instructor’s Manual Table of Contents
• Overview
• Objectives
• Teaching Tips
• Quick Quizzes
Guide to Computer Forensics and Investigations, Fifth Edition 14-2
Lecture Notes
Overview
Chapter 14 gives you guidelines on writing reports of your findings in computer
forensics investigations. You learn about different types of reports and what to include
Chapter Objectives
• Explain the importance of reports
• Describe guidelines for writing reports
• Explain how to use forensics tools to generate reports
Teaching Tips
Understanding the Importance of Reports
2. Describe the courts’ requirements for expert witness’ reports such as:
a. Expert’s opinion
3. Explain deposition banks and how they are used in preparation for a trial.
Limiting a Report to Specifics
1. Explain the advantages of clearly stating your job mission or goal in your investigation
reports.
2. Mention that before you begin writing, you should identify your audience and the
Guide to Computer Forensics and Investigations, Fifth Edition 14-3
Types of Reports
1. Explain what an examination plan is and its purpose during a trial. Examination plans
2. Describe how to make a verbal report. Verbal reports are less structured and usually
treated as preliminary reports. Information on a verbal report includes:
a. Tests that haven’t been concluded
3. Written reports are formal reports. Usually they are used as an affidavit or declaration.
For that reason, you should pay attention to details and limit what you write.
Guidelines for Writing Reports
1. Explain how to use hypothetical questions to guide and support your opinion.
3. State the four conditions required for an expert witness to meet before testifying in
court:
a. Opinion, inferences, or conclusions depend on special knowledge, skills, or
training
b. Expert should qualify as a true expert in the field
What to Include in Written Preliminary Reports
1. Mention that anything you write down as part of your examination for a report is
subject to discovery from the opposing attorney.
3. Explain that destroying the report could be considered destroying or concealing
4. Mention that when writing a preliminary report, you should include the same
information as in verbal reports. Additional items to include in your report:
a. Summarize your billing to date and estimate costs to complete the effort
Report Structure
1. Provide guidelines for writing the following report sections:
a. Abstract
b. Table of contents
c. Body of report
Writing Reports Clearly
1. Provide guidelines for writing good reports. When writing a report you should consider:
a. Communicative quality – Is it easy to read?
b. Ideas and organization – Is the information relevant and clearly organized?
c. Grammar and vocabulary – Is the language simple and direct?
d. Punctuation and spelling – Are they accurate and consistent?
2. Explain that report organization is very important. You should lay out ideas in logical
3. Pay attention to your writing style:
a. Avoid jargon, slang, and colloquial terms
b. Define technical terms
c. Use a natural language style
d. Avoid repetition and vague language
Designing the Layout and Presentation of Reports
1. Describe both of the following layout systems:
2. Explain additional considerations about the layout and presentation of reports such as:
a. Providing supporting material
b. Formatting consistently
c. Explaining examination and data collection methods
Whether you are working for a law firm, digital forensics firm, research
Quick Quiz 1
1. Besides presenting facts, an investigation report can communicate ____ opinion.
2. Libraries where attorneys can deposit and withdraw examples of expert witnesses’
previous testimony are known as _____.
3. A(n) ____ is a document that lets you know what questions to expect when you are
testifying.
4. A report using the ____ system divides material into sections and restarts numbering
with each main section.
5. If you use any hashing algorithms, be sure to give the _____.
Generating Report Findings with Forensics Software Tools
1. In this section, you will demonstrate to your students how to use the reports generated
2. Point out that although forensics software reports what evidence was found and where,
3. Mention to students that these reports and logs are typically in text, word processing, or
Using ProDiscover Basic to Generate Reports
1. Use Figures 14-2 and 14-3 to illustrate how to convert a ProDiscover image file to a raw
Using OSForensics to Generate Reports
1. Explain with a complete example how to create a new case file, index the drive, analyze
Quick Quiz 2
1. True or False: ProDiscover’s report generator defaults to rich text format (RTF), which
can be opened by most word processors.
2. True or False: OSForensics has some unique features that aren’t available in
ProDiscover Basic.
Class Discussion Topics
1. Ask your students to discuss the advantages and disadvantages of creating an
examination plan and rehearsing your testimony before the actual trial.
2. What are the advantages and disadvantages of using reports generated by forensics tools
to create your final investigation report?
Additional Projects
1. Ask students to investigate at least two other report structures that you can use when
2. Ask students to learn and explain how to produce PDF documents using their favorite
Additional Resources
Guide to Computer Forensics and Investigations, Fifth Edition 14-8
2. Citing references guidelines Web sites:
Key Terms
➢ deposition banks — Libraries of previously given testimony that law firms can access.
➢ discovery — Efforts to gather information before a trial by demanding documents,
depositions, interrogatories (written questions answered in writing under oath), and
written requests for admissions of fact.