Computer Forensics JumpStart, Second Edition

Creating Easy-to-Use Reports

Every report should begin with a clear and concise summary of the facts of the case and evidence gathered. The purpose of the summary is to provide the client (or court) with a high-level overview of the evidence gathered and the conclusions drawn based on the evidence. The summary is meant to provide the client or court with a snapshot of the facts and evidence. Remember, the client or court will be able to read the full details in the body of the report—the summary is merely an overview.

During an investigation, it’s easy to gather large amounts of evidence. While such evidence can be stored on an 8 GB USB flash drive (also known as UFD), if its contents were printed, it could generate a stack of paper approximately ...