Report Writing Handbook for the Computer Forensic Examiner: Law Enforcement Edition

It starts off by laying the foundation of expert witness report writing. It demonstrates the difference between electronic discovery productions and writing an expert forensic report. The forensic report not only contains the basics that should be in any report, but also the expert's opinions, which are based on factual objective findings.

This book contains the following sections:

Starting Your Analysis

There are many ways to start the analysis and this section provides some structure to help quickly triage the analysis. By "walking the path," the examiner can quickly pick up on how a person used the computer, which provides direction for follow-up analysis. Use of virtual environment software, such as VMware, can be an extremely valuable aid during the analysis and for providing a demonstrative exhibit.

Case Study

To help prepare for the report writing section, a sample case study is provided. This case walks through potentially relevant information that was discovered through the forensic analysis. Screenshots are used throughout the study to help provide a visual depiction and bring the case to life.

Writing Your Report

A sample format of an expert witness report is provided as a roadmap to prepare the expert report. The report writing process is completed by using the information from the case study.

Inside The Courtroom

At some point in the forensic examiner's career, the examiner may be called upon to testify in court. This section provides some helpful insight as to what to expect during trial and the types of questions may be asked during cross-examination.

The Appendix of this handbook provides additional sample reports as guides to offer examples for organizing and formatting forensic reports. Additionally, it provides a case study to demonstrate timeline analysis, which can help to connect other events and people behind the keyboard.