Report Writing Handbook for the Computer Forensic Examiner: Law Enforcement Edition

The Report Writing Handbook for the Computer Forensic Examiner is intended to be the student manual in a formal law enforcement report writing class, which is geared for computer forensic examiners who are tasked with writing an expert witness report and may be called to testify in trial.

It starts off by laying the foundation of expert witness report writing. It demonstrates the difference between electronic discovery productions and writing an expert forensic report. The forensic report not only contains the basics that should be in any report, but also the expert’s opinions, which are based on factual objective findings.

This book contains the following sections:

Starting Your Analysis

There are many ways to start the analysis and this section provides some structure to help quickly triage the analysis. By “walking the path,” the examiner can quickly pick up on how a person used the computer, which provides direction for follow-up analysis. Use of virtual environment software, such as VMware, can be an extremely valuable aid during the analysis and for providing a demonstrative exhibit.

Case Study

To help prepare for the report writing section, a sample case study is provided. This case walks through potentially relevant information that was discovered through the forensic analysis. Screenshots are used throughout the study to help provide a visual depiction and bring the case to life.

Writing Your Report

A sample format of an expert witness report is provided as a roadmap to prepare the expert report. The report writing process is completed by using the information from the case study.

Inside The Courtroom

At some point in the forensic examiner’s career, the examiner may be called upon to testify in court. This section provides some helpful insight as to what to expect during trial and the types of questions may be asked during cross-examination.

The Appendix of this handbook provides additional sample reports as guides to offer examples for organizing and formatting forensic reports. Additionally, it provides a case study to demonstrate timeline analysis, which can help to connect other events and people behind the keyboard.

Bruce W. Pixley is a certified forensic analyst and a retired Santa Barbara Sheriff's lieutenant who has been retained as a computer forensic examiner and subject matter expert in both criminal and civil matters. Since 2001, he has served as a lead instructor for computer forensics and high-tech courses taught by the CA Department of Justice. As an instructor, he has taught both law enforcement and corporate students for over 2,000 hours on the subjects of computer forensics and high-tech investigations. He holds multiple certifications in his field, including Certified Information Systems Security Professional (CISSP), GIAC Certified Forensic Analyst, and EnCase Certified Examiner.