Digital Forensics Explained, 2nd Edition

Chapter 8Report writing and presentation

Introduction

Report writing and presenting the findings are arts unto themselves. An investigator learns a lot about the subjects of the investigation, as well as what has occurred. However, much of what has been learned will be lost if the information is not captured in the report. Documenting investigation notes can be used to explain what is in the report and how it was arrived at, as well as background information about the investigation. The balance that an investigator has to grapple with is how much information to put in a report. Too much information and the details tend to be over-looked. If there is too little information, the report appears incomplete.

Many forensic tools generate reports ...