Guide to Computer Forensics and Investigations Fourth EditionObjectivesUnderstanding the Importance of ReportsLimiting a Report to SpecificsTypes of ReportsSlide 6Types of Reports (continued)Slide 8Guidelines for Writing ReportsGuidelines for Writing Reports (continued)What to Include in Written Preliminary ReportsWhat to Include in Written Preliminary Reports (continued)Report StructureWriting Reports ClearlyWriting Reports Clearly (continued)Slide 16Designing the Layout and Presentation of ReportsDesigning the Layout and Presentation of Reports (continued)Slide 19Slide 20Generating Report Findings with Forensics Software ToolsUsing ProDiscover Basic to Generate ReportsSlide 23Using ProDiscover Basic to Generate Reports (continued)Using FTK Demo to Generate ReportsUsing FTK Demo to Generate Reports (continued)Slide 27Slide 28Slide 29Slide 30Slide 31SummarySummary (continued)Guide to Computer Forensics and InvestigationsFourth EditionChapter 14Report Writing for High-Tech InvestigationsGuide to Computer Forensics and Investigations 2Objectives•Explain the importance of reports•Describe guidelines for writing reports•Explain how to use forensics tools to generate reportsGuide to Computer Forensics and Investigations 3Understanding the Importance of Reports•Communicate the results of your investigation–Including expert opinion•Courts require expert witness to submit written reports•Written report must specify fees paid for the expert’s services–And list all other civil or criminal cases in which the expert has testified•Deposition banks–Examples of expert witness’ previous testimoniesGuide to Computer Forensics and Investigations 4Limiting a Report to Specifics•All reports to clients should start with the job mission or goal–Find information on a specific subject–Recover certain significant documents–Recover certain types of files•Before you begin writing, identify your audience and the purpose of the reportGuide to Computer Forensics and Investigations 5Types of Reports•Computer forensics examiners are required to create different types of reports•Examination plan–What questions to expect when testifying–Attorney uses the examination plan to guide you in your testimony–You can propose changes to clarify or define information–Helps your attorney learn the terms and functions used in computer forensicsGuide to Computer Forensics and Investigations 6Guide to Computer Forensics and Investigations 7Types of Reports (continued)•Verbal report–Less structured–Attorneys cannot be forced to release verbal reports–Preliminary report–Addresses areas of investigation yet to be completed•Tests that have not been concluded•Interrogatories•Document production•DepositionsGuide to Computer Forensics and Investigations 8Types of Reports (continued)•Written report–Affidavit or declaration–Limit what you write and pay attention to details•Include thorough documentation and support of what you writeGuide to Computer Forensics and Investigations 9Guidelines for Writing Reports•Hypothetical questions based on factual evidence–Less favored today–Guide and support your opinion–Can be abused and overly complex•Opinions based on knowledge and experience•Exclude from hypothetical questions–Facts that can change, cannot be used, or are not relevant to your opinionGuide to Computer Forensics and Investigations 10Guidelines for Writing Reports (continued)•As an expert witness, you may testify to an opinion, or conclusion, if four basic conditions are met:–Opinion, inferences, or conclusions depend on special knowledge or skills–Expert should qualify as a true expert–Expert must testify to a certain degree of certainty–Experts must describe facts on which their opinions are based, or they must testify to a hypothetical questionGuide to Computer Forensics and Investigations 11What to Include in Written Preliminary Reports•Anything you write down as part of your examination for a report–Subject to discovery from the opposing attorney•Considered high-risk documents•Spoliation–Destroying the report could be considered destroying or concealing evidence•Include the same information as in verbal reportsGuide to Computer Forensics and Investigations 12What to Include in Written Preliminary Reports (continued)•Additional items to include in your report:–Summarize your billing to date and estimate costs to complete the effort–Identify the tentative conclusion (rather than the preliminary conclusion)–Identify areas for further investigation and obtain confirmation from the attorney on the scope of your examinationGuide to Computer Forensics and Investigations 13Report Structure•Structure–Abstract–Table of contents–Body of report–Conclusion–References–Glossary–Acknowledgements–AppendixesGuide to Computer Forensics and Investigations 14Writing Reports Clearly•Consider–Communicative quality–Ideas and organization–Grammar and vocabulary–Punctuation and spelling•Lay out ideas in logical order•Build arguments piece by piece•Group related ideas and sentences into paragraphs–Group paragraphs into sectionsGuide to Computer Forensics and Investigations 15Writing Reports Clearly (continued)•Avoid jargon, slang, and colloquial terms•Define technical terms–Consider your audience•Consider writing style–Use a natural language style–Avoid repetition and vague language–Be precise and specific–Use active rather than passive voice–Avoid presenting too many details and personal observationsGuide to Computer Forensics and Investigations 16Writing Reports Clearly (continued)•Include signposts–Draw reader’s attention to a pointGuide to Computer Forensics and Investigations 17Designing the Layout and Presentation of Reports•Decimal numbering structure–Divides material into sections–Readers can scan heading–Readers see how parts relate to each other•Legal-sequential numbering–Used in pleadings–Roman numerals represent major aspects–Arabic numbers are supporting informationGuide to Computer Forensics and Investigations 18Designing the Layout and Presentation of Reports (continued)•Providing supporting material–Use material such as figures, tables, data, and equations to help tell the story as it unfolds•Formatting consistently–How you format text is less important than being consistent in applying formatting•Explaining examination and data