Chapter 9: Pulling It AllTogether

In This Chapter

• Creating proper and thorough documentation

• Formulating a concise analysis report summary

• Exploring model analysis reports and sample reports

• Using software for creating reports

In the last chapter, you learned about the various types of forensic tools used to gather evidence. Prior to that, you learned about capturing and extracting data. Through each step of the way you should be documenting what you are doing along with the evidence you find. Besides being familiar with the process of gathering information, data, and material that may be related to criminal activity, forensic investigators must also be skilled in the area of documentation. Throughout the forensic process, the investigator has the ability to extract and examine mounds of information. At times, this can be intimidating as well as overwhelming. Somehow, in the end, all of this information has to be processed into a succinct report that is understandable to a judge and jury.

Properly documenting the steps taken during the evidence-gathering process must be a top priority. Good documentation, along with sound forensic procedures, is essential for success in prosecuting computer crime cases. Crucial evidence is subject to question, and the qualifications of the expert witness can become an issue if the computer evidence was not documented systematically. This is why being able to accurately reconstruct an investigation is a critical skill.

It's time to look at what information you might need and how to put all this information together in an analysis report that is concise yet detailed enough to explain your findings. This chapter examines this process and looks at several sample reports so you can get an idea of the type and quality of documentation you will need for your case.