Chapter 10: Reports

Question 1

what is the foundation to your reporting

Answer 1

your notes

Question 2

what are the fundamental elements of notetaking

Answer 2

• when you did smth
• what you did
• what you saw
• why you did smth

Question 3

when does notetaking start

Answer 3

• when you get the notification/ you have to respond to the scene
• including time, who notified you, when you arrive at scene

Question 4

why are we willing to alter digital evidence when collecting RAM

Answer 4

cause it would be lost if it wasn’t collected in time

Question 5

are notes taken by hand or digital?

Answer 5

up to the person (but be consistent)

Question 6

what is the purpose of the report

Answer 6

• to document the results of your examination
• can be used in court/ administrative proceedings

Question 7

what is a general template that can address the technical and non-technical audience

Answer 7

• administrative info
• executive summary
• narrative
• exhibits/ technical details
• glossary

Question 8

what sort of info is in the administrative section

Answer 8

• name of agency, case number, participants
• when it started and what happened before you were called onto the case

Question 9

what sort of info is in the executive summary

Answer 9

• should only be 10% of report
• short, concise paragraphs
• follow same timeline as narrative
• not include info not in narratuve
• contain findings/ conclusions

Question 10

what is the difference between the executive summary and narrative

Answer 10

• executive summary is in easy plain language that anyone can understand, and very summed up and to the point
• narrative explains EVERYTHING with the precise terms for the experts

Question 11

what are the sections within the narrative

Answer 11

• evidence analyzed
• acquisition details
• analysis details
• exhibit/ technical details

Question 12

what is described in the evidence analyzed section of the narrative

Answer 12

include all evidence examined, including make/model, serial numbers etc

Question 13

what is described in the acquisition details section of the narrative

Answer 13

• describe the acquisition process of creating the forensic image(s)
• hardware/software used in the process and version numbers

Question 14

what is described in the analysis details section of the narrative

Answer 14

• analyse the artifacts and explain why it is relevant to the investigation to the reader
• include ss, AND explain what the ss is showing, don’t assume they know what the ss means

Question 15

what is described in the exhibit/ technical details section of the narrative

Answer 15

• ss of the artifacts should be placed here
• include output reports of the tools used in the exam process
• literally anything you reference in your narrative should be here