Digital Forensics Report Preparation

The reader of a report is usually not a technical expert. A report that cannot be understood fails its purpose, however accurate it is.

A report's value depends as much on clarity and defensibility as on technical depth: how each finding was obtained should be described clearly enough for another expert to repeat it.

• Identification of the digital material examined
• Explanation of the examination methods and tools used
• Documentation of chain of custody records
• Structured presentation of findings
• Screenshots and exhibits supporting the findings
• Plain-language explanations of technical terms
• Clear statement of the scope and limitations of the examination
• Objective conclusions

We state the scope and limitations of the examination clearly: what was not examined is recorded as well as what was. Findings are reported without commentary, and technical assessment and inference are kept in separate sections.

1. Intake and custody: we confirm the requester's legal authority, sign a non-disclosure agreement and receive the material with a signed evidence handover record. The chain of custody is documented from this point on.
2. Compiling examination records: every procedure, tool and hash value is carried over from the working notes into the report.
3. Draft and internal review: before delivery, the report is checked to make sure findings are traced to source and the language is clear.
4. Reporting and return: findings are reported together with the scope and limitations of the work. The material is returned against a signed record and working copies are either not retained at all or kept for 3 or 6 months, as the client prefers, and then securely destroyed.

Duration varies from case to case depending on the type of device or material, the data volume and the scope of the examination. We share an estimated timeframe after the initial assessment.

Parties to legal proceedings, in-house legal and internal audit teams, and law firms.