Hello everyone
New user here, currently a student at university studying forensics, I have a dilemma at the moment. I have been given an image to analyse to recover criminal data and need to write a report that would be worthy of a court setting.
My issue is I dont know what needs to be put into the report and cannot find a template to give a rough idea. Can anyone point me in the right direction or offer any advice, also Im in the UK if that makes any diffrence to how a report should be produced.
Thanks
Fascinating.
Sorry, I don't have anything to share as a response…I'm more fascinated with the fact that you've been given an assignment and not what's needed to complete it. One would think that in such a case, you'd be given the report to fill out, and have to do the analysis.
Maybe this is why there's all this talk about a skills shortage.
Fascinating.
Sorry, I don't have anything to share as a response…I'm more fascinated with the fact that you've been given an assignment and not what's needed to complete it. One would think that in such a case, you'd be given the report to fill out, and have to do the analysis.
Maybe this is why there's all this talk about a skills shortage.
I understand you opinion but maybe your just as bad as them then not sharing your knowledge ir maybe you dont know yourself which adds to the shortage.
Your response is just pretentious but than you all the same.
I did say that I didn't have anything to share…I don't do work that has to go to court.
In "Windows Forensic Analysis 4/e", I did provide an entire chapter on report writing, but again…I do not do work that ends up going to court. I have assisted LE, but I show them how I did the work, and do not get to see the end product.
I just find it unproductive to give someone an assignment to create a report to be used in court without ever telling them what that is.
Hello everyone
New user here, currently a student at university studying forensics, I have a dilemma at the moment. I have been given an image to analyse to recover criminal data and need to write a report that would be worthy of a court setting.
My issue is I dont know what needs to be put into the report and cannot find a template to give a rough idea. Can anyone point me in the right direction or offer any advice, also Im in the UK if that makes any diffrence to how a report should be produced.
Thanks
Report Writing Handbook for the Computer Forensic Examiner Law Enforcement Edition Paperback – March 11, 2014
You may find
Homi576,
Not wishing to be too critical of your request and my disposition is to be helpful rather than pour scorn on anyone, but you're one of hundreds of people who have joined the forums over the years and made requests like these without indicating what you've tried so far. Keydet has helped more people on these forums than you would imagine. He does get frustrated when requests come across in a way that suggests the person asking hasn't done anything to get started on the problem.
The first point I would make is asking what format the report should be in is part of forensics! Not every report follows the same template. It depends on what we're trying to prove/disprove, what importance the digital evidence plays in the case and so on. If the tutor refuses to give you any clues then maybe it's a test to see what you come up with. Most likely the tutor will provide some direction if asked.
The second point is your written English. You may feel the forums are an informal place to post or you may not realise your mistakes. It's good to always write to your highest standard. Your second post for example contains the errors "I understand you opinion..", "but maybe your as bad as…" and "sharing your knowledge ir maybe…". Obviously two look like typos but the middle one should be "you're". Any report written with these sorts of errors, irrespective of the quality of the content isn't even going to make it to the court room. Either side would be embarrassed to use it.
There are many resources out there if you look. The Criminal Procedure Rules documentation will provide details on the purpose of a report and the role of an expert in a criminal case. This gives you the framework to understand how to work out what someone needs from you and from your report. I would be very surprised if nothing has been covered in your course about these resources.
The next observation is that forensic analysis is not and should never be based on someone asking someone for some information and then that person just using that information. Testing and validation within forensic disciplines means you do it yourself, you verify it yourself and you prove it works that way yourself without relying on a tool, or another person telling you to do this or do that. The underlying knowledge the industry needs to come from the next generation of practitioners is that they do not 'Google' for an answer and then utilise that. Asking in the manner you did without providing information about what you've already worked out and done suggests you are not being taught to understand this important premise.
In terms of reports most police forensic laboratories will have some templates for reports but these will be restricted documents to some extent. Police or criminal defence analysts will therefore be unable to point you to something or provide you with something. You couldn't have known this but this is why you aren't getting a stream of 'helpful' replies.
When using these forums you will get so much help when you post saying what you've done, what you've researched, what you've tried and failed at and so on.
Remember this isn't a career anyone should go into lightly. The best practitioners don't go into it for themselves and they absolutely will have to cancel their evening plans, a holiday or two and tell their spouse/partner "I'm sorry I am going to be stuck here for some time" more times than you can count. We hold enormous power to decide whether someone will be found guilty or not. If we are defending and we don't do our job properly….And if we work for the prosecution and we get something wrong and the defendant walks free and kills again….
Basically this career requires the greatest amount of commitment and maybe you have that and you have exhausted hours of research before posting here. Most of us have been on these forums for a long time and have seen many students come and go, showing no desire to give their best. One of the ways we can see the difference between those that really want to do this and those that don't view this career the way it should be viewed, is to show what they've done themselves before asking for help.
I don't post long replies to criticise because I get nothing from it. I post this reply because I think it can help you. I hope you view it that way.
Steve
Fascinating.
Sorry, I don't have anything to share as a response…I'm more fascinated with the fact that you've been given an assignment and not what's needed to complete it. One would think that in such a case, you'd be given the report to fill out, and have to do the analysis.
Maybe this is why there's all this talk about a skills shortage.
Yeah it's not that surprising; I've seen a number of masters subjects where they just throw you in the deep end and expect you to either know it already, or research and guess what's the right way to do things. Their argument is usually "it's a masters level course", except that, at least in Australia, there's no bachelors level course so people are usually starting in the field from scratch.
Having said that, to OP, I did a forensics subject back at university and they did something quite similar; don't stress too much about whether the template you choose is perfect.
For example; you should probably have an introduction, scope, findings, summary, glossary, cv
You can add more or less depending on what you feel is important (ie since it's a criminal matter, chain of custody might be important)
I'd focus on making the document look professional and have content that you would be able to back up with community research as well as your own testing.
If you really wanted to go the extra distance however, memberships to IACIS or HTCIA aren't very expensive and may be worth exploring
Homi576,
Not wishing to be too critical of your request and my disposition is to be helpful rather than pour scorn on anyone, but you're one of hundreds of people who have joined the forums over the years and made requests like these without indicating what you've tried so far. Keydet has helped more people on these forums than you would imagine. He does get frustrated when requests come across in a way that suggests the person asking hasn't done anything to get started on the problem.
The first point I would make is asking what format the report should be in is part of forensics! Not every report follows the same template. It depends on what we're trying to prove/disprove, what importance the digital evidence plays in the case and so on. If the tutor refuses to give you any clues then maybe it's a test to see what you come up with. Most likely the tutor will provide some direction if asked.
The second point is your written English. You may feel the forums are an informal place to post or you may not realise your mistakes. It's good to always write to your highest standard. Your second post for example contains the errors "I understand you opinion..", "but maybe your as bad as…" and "sharing your knowledge ir maybe…". Obviously two look like typos but the middle one should be "you're". Any report written with these sorts of errors, irrespective of the quality of the content isn't even going to make it to the court room. Either side would be embarrassed to use it.
There are many resources out there if you look. The Criminal Procedure Rules documentation will provide details on the purpose of a report and the role of an expert in a criminal case. This gives you the framework to understand how to work out what someone needs from you and from your report. I would be very surprised if nothing has been covered in your course about these resources.
The next observation is that forensic analysis is not and should never be based on someone asking someone for some information and then that person just using that information. Testing and validation within forensic disciplines means you do it yourself, you verify it yourself and you prove it works that way yourself without relying on a tool, or another person telling you to do this or do that. The underlying knowledge the industry needs to come from the next generation of practitioners is that they do not 'Google' for an answer and then utilise that. Asking in the manner you did without providing information about what you've already worked out and done suggests you are not being taught to understand this important premise.
In terms of reports most police forensic laboratories will have some templates for reports but these will be restricted documents to some extent. Police or criminal defence analysts will therefore be unable to point you to something or provide you with something. You couldn't have known this but this is why you aren't getting a stream of 'helpful' replies.
When using these forums you will get so much help when you post saying what you've done, what you've researched, what you've tried and failed at and so on.
Remember this isn't a career anyone should go into lightly. The best practitioners don't go into it for themselves and they absolutely will have to cancel their evening plans, a holiday or two and tell their spouse/partner "I'm sorry I am going to be stuck here for some time" more times than you can count. We hold enormous power to decide whether someone will be found guilty or not. If we are defending and we don't do our job properly….And if we work for the prosecution and we get something wrong and the defendant walks free and kills again….
Basically this career requires the greatest amount of commitment and maybe you have that and you have exhausted hours of research before posting here. Most of us have been on these forums for a long time and have seen many students come and go, showing no desire to give their best. One of the ways we can see the difference between those that really want to do this and those that don't view this career the way it should be viewed, is to show what they've done themselves before asking for help.
I don't post long replies to criticise because I get nothing from it. I post this reply because I think it can help you. I hope you view it that way.
Steve
That post should be a sticky. One of several that should be required reading for those joining the forum. Well articulated sir.
Hmph.
The next observation is that forensic analysis is not and should never be based on someone asking someone for some information and then that person just using that information. Testing and validation within forensic disciplines means you do it yourself, you verify it yourself and you prove it works that way yourself without relying on a tool, or another person telling you to do this or do that. The underlying knowledge the industry needs to come from the next generation of practitioners is that they do not 'Google' for an answer and then utilise that. Asking in the manner you did without providing information about what you've already worked out and done suggests you are not being taught to understand this important premise.
I have no idea how this relates to writing a forensic report. And what if you ask the defendant for a PIN number for his iPad? Isn't that "someone asking someone for some information and then that person just using that information"? How would you go about testing and validating that info before using it on the exhibit? )
To the OP; assuming you're doing an end-to-end job then break your report down into these areas and you should be OK
- Introduction (who you are and why you're qualified to do this)
- Summary of exhibits
- Summary of evidence
- Details of findings (for each exhibit)
The first page should be similar to
Personally I like to number my paragraphs, but that's not a ciritcal thing so don't feel you have to include it.
That is probably enough. Make sure you avoid opinions and information which you don't know to be true. STICK TO THE FACTS, SON.