Mastering Windows Network Forensics and Investigation, 2nd Edition

Creating a Narrative Report with Hyperlinks

When you have completed your investigation in a network case, you’ll have many very detailed and complex reports. You might have a separate report or spreadsheet for each of the many logs you examined in the case. You might have records from ISPs based on subpoena requests. You might have separate registry reports for each of the many registries involved in a case. You might have forensics reports for each involved machine or multiple reports for the same machine but from different forensic software tools. For instance, you might generate both an EnCase and an FTK report for the same computer, taking full advantage of the feature sets of both tools. It is, therefore, not uncommon for such a case to ...