Writing the forensic report

The forensic report is the expert's evidence. In many proceedings it is read long before anyone testifies, and in some it is the only form the evidence ever takes. A report that mixes observation with opinion, hides its materials or uses undefined probability words invites a challenge that a well-structured report would have closed off in advance.

The craft of analytical writing is covered in the IDFE-BA lessons Writing the analytical report and Confidence, uncertainty and language: bottom line first, findings written as claim, evidence, reasoning and confidence, a declared likelihood scale, transaction appendices built by query. This lesson adds the layer a court needs on top.

What changes when the report is evidence

A structure that courts recognize

Forensic reporting standards converge on the same building blocks. The SWGDE Requirements for Report Writing in Digital and Multimedia Forensics (document 18-Q-002, version 1.0, 2018) sets minimums such as the request and its authority, the items examined with identifiers like hash values, results a layperson can understand, opinions with their basis, and the disposition of items. ISO 21043-5:2025 adds that reports must be fit for their intended use, and ISO/IEC 17025:2017 clause 7.8 governs reports issued by accredited laboratories. A structure that satisfies all three:

1. Instructions: who instructed the expert, when, under what authority (warrant, court order, contract), and the questions, quoted exactly.
2. Qualifications: relevant training, experience, accreditation and prior testimony, kept to what bears on these questions; a full CV goes in an appendix.
3. Materials: every item received or collected (exports, images, records, tool outputs), each with identifier, date received, source and SHA-256 hash, plus anything requested but not provided.
4. Methods: data sources and node or dataset versions, tools and versions, tracing method and stopping rules, heuristics, label sources and dates, the confidence scale used, and any deviation from the unit's procedures.
5. Findings: what was observed, finding by finding, with references to appendix rows.
6. Limitations: what could not be seen or tested, and what would change the conclusions.
7. Conclusions: a direct answer to each question, in the same order as the instructions.
8. Declaration: the expert's statement of duty, signed and dated.

Answering the questions in the order they were asked matters more than it seems: a judge reading conclusions should find the answer to question 3 under "Question 3", not spread across three findings.

Separating facts from opinions

ISO/IEC 17025:2017 clause 7.8.7 requires that opinions and interpretations in reports be clearly identified as such, and that the basis for them be documented. The ENFSI Guideline for Evaluative Reporting in Forensic Science (2015) distinguishes three kinds of output that map well onto crypto work:

• Technical reporting describes findings without evaluation: the transaction, the block, the amount.
• Investigative reporting offers explanations for findings when no pair of competing propositions can yet be framed, typically early in a case: "the pattern is consistent with a deposit address at a custodial service".
• Evaluative reporting assesses findings against at least one pair of competing propositions, usually one from each party's account, and is what a court normally needs at trial.

A simple convention makes the split visible to any reader: begin paragraphs with "Observation" or "Opinion", or keep them in separate subsections for each finding. An observation carries a citation and no probability word. An opinion names the method and states the alternative it was weighed against.

Confidence language for the court

The likelihood scales taught in IDFE-BA, such as "very likely (80–95%)", grade how probable a proposition is. They suit intelligence and compliance work. In court, a problem appears: the probability of a proposition, such as "this wallet belongs to the defendant", depends on all the evidence in the case, much of which the expert has not seen. The forensic answer is to report the strength of support that the expert's findings give to one proposition over another.

The ENFSI guideline sets four requirements for evaluative opinions: balance (at least two propositions), logic (address the probability of the findings given each proposition, not the probability of the propositions given the findings), robustness (reasoning that withstands scrutiny and rests on appropriate data) and transparency (a demonstrable process recorded in the case file and the report). Its illustrative verbal scale is based on the likelihood ratio, how many times more probable the findings are under one proposition than the other:

Few tracing heuristics come with numeric likelihood ratios, so most crypto reports use such terms verbally, with the reasons stated. What matters is the logic. Suppose an amount-and-time match found one candidate release in a window that would, by chance, contain a matching release about once in 100 comparable windows. The correct statement is "if the release were unrelated to the deposit, a match this close would be expected about once in 100 windows". If a genuinely related release would almost always produce such a match, the likelihood ratio is roughly 100, on the boundary between moderate and moderately strong support. Writing "there is only a 1% chance the release is unrelated" is the transposed conditional, often called the prosecutor's fallacy: it silently converts a probability of the findings into a probability of the proposition. Declare one scale in the methods section and never mix intelligence terms and support terms in the same report.

Appendices and reproducibility

Appendices make the report checkable: full transaction tables with block hashes (see the IDFE-BA lesson Writing the analytical report), flow charts and timelines (see the lesson Visual evidence for courts), the materials list with hashes, and the evidence package that lets another examiner re-perform the work (see Preserving on-chain evidence). Many units keep each finding as a structured record from which both the report text and the appendices are generated:

{
  "finding_id": "F3",
  "question": 2,
  "type": "opinion",
  "statement": "bc1q…k8p0 is a deposit address of Exchange K",
  "propositions": ["deposit address of Exchange K", "address unrelated to Exchange K"],
  "basis": ["appendix_A_rows_14_16", "appendix_B_row_21", "exchange_k_published_reserve_list_2026-03-20"],
  "method": "sweep pattern and common-input heuristic, CoinJoin and PayJoin excluded",
  "support": "strong support for the first proposition",
  "limitations": ["path relies on change detection over 4 hops"],
  "tools": [{"name": "examiner graph tool", "version": "4.2.1"}],
  "data_cutoff": {"bitcoin_block": 941350}
}

The record ties the finding to the question it answers, labels it as opinion, names both propositions, lists its basis by appendix row and dated source, and records method, tool version and cut-off. A reviewer can check each element; a report generator cannot drop the limitation without it showing.

Declaration, signature and amendments

The declaration is where the expert attests to the duties covered in the lesson The expert's role and duties. Wording varies by system, but it typically states that the expert understands their duty to the court and has complied with it, that the opinions are their own and within their expertise, that they have mentioned all matters they consider relevant, including those that detract from their opinions, that they have disclosed any conflict of interest, and that they will notify the court if their opinion changes.

Once issued, a report is never silently edited. ISO/IEC 17025:2017 clause 7.8.8 requires that changes to an issued report be clearly identified, with the reason where appropriate, and that a replacement report be uniquely identified and reference the original it replaces. In crypto cases, amendments are common because exchange records arrive late or funds move again after the cut-off. Each amendment should state what changed, why, and which conclusions are affected, so the court can see that the expert updated the opinion because of evidence, not pressure.

Exam focus: how a forensic report differs from an analytical report (named signing expert, verbatim questions, hashed materials, labeled opinions, formal amendments, declaration); the eight-part structure and answering questions in order; SWGDE minimums for report content and the ISO/IEC 17025 requirement to identify opinions and interpretations and document their basis; technical, investigative and evaluative reporting; ENFSI balance, logic, robustness and transparency; likelihood ratio and its verbal scale; recognizing the transposed conditional (prosecutor's fallacy); structured finding records; declaration contents and amendments that identify each change, give the reason and reference the original report.