Not if that is all that is required. You could always produce further exhibits at a later date if new intelligence/evidence comes to light.
Looking at some of the replies Oh how I wish I worked in your area. Obviously I dont know if you are LE but up in the north of England - or at least in my Force (sorry Service) area our CPS have sort of dictated the way we produce evidence.
Everything is done in Statement form as they argue a seperate report has to be disclosed anyway so why not have it all in one document so I will start with that.
Statement has to begin with a short resume of my qualifications and training. At the moment this takes about a page. After that I am free to format what is needed in it as I wish so this is what I do.
Start of with a brief resume of the facts we have been given about the case followed by a brief resume of what we have been asked to look for and why.
Following this I put in the continuity of the exhibits - i.e what was received, exhibits numbers etc and what happened to them which is normally logged, documented and stored pending examination.
Then continue with the imaging process part of it followed by the examination part of it - what we found etc etc.
The way our CPS charge means that every image subject of a charge has to be individually identified in the charge so for example if I recover 100 illegal images, those being 20 of each category, the charges would read
Possession of 1 cat 1 image
Possession of 19 cat 1 images
etc etc etc for other cats.
Of course this means that each seperate image has to be named in the charge and uniquely identifiable.
So One folder with 100 images would have exhibit numbers as follows
Folder = exhibit MJ1
each image would be MJ1-1 to MJ1-100 (good eh?)
Screen snaps and text fragments are put in the SoE and are not given seperate exhibit numbers.
All images etc are put onto encrypted DVD and the DVD is exhibited.
This is done as no images are given to the defence. If they wish to see them they have to come to a Police Station or a Police officer takes it to them with one of our laptops but either way the images are never let out of the sight of the officer in case.
As I go through the statement, when I come to a part of it that would require some explanation i.e Temporary Internet Files, Index buffers,Registry etc etc then I will put a brief simplified explanation of what it all means and how it works before the evidence relating to that matter so the reader has an understandingof it before he reads it. Ideal for non computer literate policemen which seems to be most of them.
Needless to say when we get a job in with a couple of hundred thousand images all nicely foldered away (or worse still not nicely folder but all over the drive) the statements can run to a hundred pages. Largest one I have done was over 400 pages long!!!!!!!
Still - CPS know best.
I would also be careful of giving an opinion on what it all means. That is sort of standing up and asking someone to knock you over. Phrases like "it suggests that" or would support the allegation that" are better. Your not giving an opinion but still getting across what you think of course that way leaves it open for the other side to come back at you with "So this may have happened" etc etc.
What do you think of this witness statement? I'm thinking it is extremely brief but i don't know exactly what is required yet, so….
I, Add0 of
"address"
Declare that
I am employed by "company" as a Computer Forensics Investigator and have been since "date" at the above address.
I am a British Citizen born on the "date" in the North East of England.
I am not associated with "client", other than in the context of the contract for Forensic Services to "company".
The information presented in this Witness Statement is factual to the best of my knowledge.Facts
1. "company" performed a live forensic acquisition, of the Hard Disk Drive Arrays of "clients" server in person on the "date".
The Server image has been documented as SS/FOR166/AO/I/E1/001
2. The evidence files from SS/FOR166/AO/I/E1/001 were analysed using a number of Computer Forensic software packages. The results of this analysis are included in Exhibit A - Forensic Investigation Report.
3. The Hard Disk Drive images were kept securely on "company" premises.
I, hereby state that this Witness Statement is complete to the best of my knowledge and sign to confirm this declaration.
Signed
Dated
Oh by the way, what would you guys call yourselves in formal documentation - CF investigators? examiners? analysts? practitioners? technicians?
(Also, in the example statement above i forgot to include that an additional copy of the image was also made.)
Cheers
If you've never seen a witness statement take a look at this document for a style guide (PDF pages 107 and 108)
http//
You can ignore the notes as they are unlikely to be relevant and don't bother reproducing the back pages (witness details), but the layout and the content of the header and footer can be set up as a MS word template.
Generally this style applies to criminal cases and civil statements are different but I don't know if using a different style would throw up any real issues providing it's your work and signed by you.
As for what you call yourself, it's up to you! Just steer clear of calling yourself an expert as it has a specific legal meaning, with associated responsibilities. If you are an expert, you'll probably already know about it or someone with a wig would have told you.
For some interesting documents try the following in google wink
witness statement filetypepdf