A Practical Guide to Digital Forensics Investigations, 2nd Edition

Chapter 6

Documenting the Investigation

Learning Outcomes

After reading this chapter, you will be able to understand the following:

• How to obtain evidence from a service provider;

• How to document a crime scene;

• The process for seizing evidence;

• How to document and handle evidence;

• Forensic tools for documenting an investigation;

• Report writing;

• The role of an expert witness; and

• Standard operating procedures.

Writing a detailed comprehensive investigative report can be the key to successfully prosecuting a criminal. The report should be detailed enough to withstand the defense counsel’s objections, including claims that protocols were not followed, or issues arising from media that were not examined with enough care and consideration, or concerns ...