computer forensic reports

Since I rarely use a single tool in an investigation, I don't, commonly, use the report writing capabilities of any to format the final report.

In general, what we try to do with our reports is to tell a story. Commonly this story must be understood by the client or a jury which means wrapping considerably more information around and organizing the evidence in ways not easily supported by many of the built-in report writers.

In addition, we have developed certain "styles" to support the image that we want to project of our company. Selling our services, not those of Guidance or Access, is what we are about and for that reason we have put a lot of thought and effort into how we format our reports.

Finally, there is the real practical issue of controlling the message; how it is presented and what it is intended to convey. If it is included in our report, even in a screen shot or appendix, it is fair game for cross-examination and potential impeachment of testimony. We prefer to have more control over the information which is presented than what we are afforded by most tools.

Even two cases of the same type and same amount of data can produce totally different reports. You also need to understand a bit more than give me a sample report. Have you talked with your "clients" to see if they want a report? Report = discoverable and most wont want them. Also report can contain proprietary information which could be public record and that is another reason for not wanting to write it.

Reports are something people craft over time and experience, through their work, testifying, investigation, they tailor a report which they find is the easiest for clients to use. Kinda hard to say hey can I have that report from all the work you did, much different than asking where this file or that file resides.

Same as asking for a copy of a contract or rate sheet. If you're a company, you should go to the counsel which you pay to handle your business matters and go over a report with them, they will likely help you with language and a disclaimer etc.

Yep I totally understand, all I'm trying to do is get an idea as to what is floating around in people's reports.

Having spend over 20yrs in law enforcement, I fully understand people will create different reports over time, yes there are guide lines out there, NIJ seems to be the main one.

I'm not looking to steal someone else's report, just wanted to see what has been happening with reports in the civil and private end.

lets face it no one really reads 100+pages of a report unless your talking about some really serious crime.

I'm not looking to steal someone else's report, just wanted to see what has been happening with reports in the civil and private end.

I don't think that anyone, especially me, was suggesting that you might want to steal someone else's report.

What I was suggesting is that the report should project the image of the business that you want to project. To that extent, there should be some uniqueness to the report even if the content is relatively standardized.

Many decades ago, Xerox decided that they no longer wanted to be a photocopier company and, instead, wanted to be in the business of document management. They did a great deal of research on corporate practices and found that the corporations who had standardized their documents, including such things as where the logo appeared, what font was used, how documents were organized, etc., were perceived as being more professional and more successful than companies that had no such "style" policies. This was just about the time that word processors were starting to be common.

My point is that your report should reflect you and should say something about you, your business and the services that you offer. To that extent, the report design should reflect your objectives as a business rather than what someone else does.

Getting a forensic analysis application to create its own report reminds me of self-replicating robots and is just as scarey. The programs you use are just tools and can't ever make for even half decent reports. All they can do is give technical information about the evidence and the process used by that tool. They can't do one of the most important jobs of a report and our jobs as examiners and experts in the courts, to explain the technical evidence and what it means in lay terms.

Write your report yourself, get it peer reviewed, then get your mum to read it!

Also if you don't mind sharing some updated report samples that would be wonderful, I'm sure not only myself but others may benefit from different styles or formats.

Thanks

Googling 'computer forensic reports' gives a first hit from Forenis Focus http//www.forensicfocus.com/report-writing which contains 3 sample reports. Am not aware of any others. I'd not want to share reports with potential competitors myself as I see them (even when anonymised) as valuable IP.

I was going to say the same thing and more, but was told by Jamie that can't say google something anymore

Also if you don't mind sharing some updated report samples that would be wonderful, I'm sure not only myself but others may benefit from different styles or formats.

Thanks

Googling 'computer forensic reports' gives a first hit from Forenis Focus http//www.forensicfocus.com/report-writing which contains 3 sample reports. Am not aware of any others. I'd not want to share reports with potential competitors myself as I see them (even when anonymised) as valuable IP.

[lets face it no one really reads 100+pages of a report unless your talking about some really serious crime.

I don't know why you say that, I read everything in a report, how do you think you catch mistakes others make, or points you need to focus on, and as far as writing a report, if a person asks for a report, they read everything in the report, because the other side will read everything and they surely don't want to get blindsided.

Let's see some reports you have written and people can comment on them, that seems to be the better way to go. Peer review.