Writing the forensic report: confidence and language

The report is the only part of an investigation most people ever see, and in many proceedings it is the expert's evidence: read long before anyone testifies, and sometimes the only form the evidence takes. Readers act on its words. If an examiner writes "likely" meaning 60% and a compliance officer reads 90%, an account is frozen on weaker grounds than anyone intended. A report that mixes observation with opinion, hides its materials or uses undefined probability words invites a challenge a well-structured report would have closed off. This lesson covers structure, findings, the language of likelihood, confidence and support, and keeping the report checkable and honest after issue.

Know the reader

Executives need a decision (freeze, report, close); compliance teams need exact addresses, amounts and confidence per link; technical reviewers need queries, versions and parameters; the public needs a plain account with no personal data of private individuals; courts need evidence they can rely on and test. Whatever the reader, put the bottom line up front (BLUF), so that a reader who stops after the first paragraph leaves with the right conclusion and confidence. Shorter versions derived from a master report cite its identifier and version, and never contain a judgment or confidence the master does not. When the report becomes evidence, more changes:

A structure courts recognize

The SWGDE Requirements for Report Writing in Digital and Multimedia Forensics (18-Q-002, version 1.0, 2018) sets minimums such as the request and its authority, items examined with identifiers like hash values, results a layperson can understand, opinions with their basis, and the disposition of items. ISO 21043-5:2025 requires reports fit for their intended use, and ISO/IEC 17025:2017 clause 7.8 governs reports of accredited laboratories. A structure that satisfies all three:

1. Instructions: who instructed, when, under what authority, and the questions quoted exactly.
2. Qualifications: what bears on these questions; the full CV goes in an appendix.
3. Materials: every item received or collected, with identifier, date, source and SHA-256 hash, plus anything requested but not provided.
4. Methods: data sources and node or dataset versions, tools and versions, tracing method and stopping rules, heuristics, label sources and dates, the declared scale, the data cut-off as block heights per chain, and any deviation from the unit's procedures.
5. Findings: finding by finding, with references to appendix rows.
6. Limitations: what could not be seen or tested, alternatives considered, and what would change the conclusions.
7. Conclusions: a direct answer to each question, in the order asked.
8. Declaration: the expert's statement of duty, signed and dated.

An analytical report instead opens with a title block (identifier, version, distribution limits, cut-off) and three to five numbered key judgments. Either way, the answer to question 3 belongs under "Question 3", not spread across three findings.

Fact, inference, assumption, opinion

Before choosing words, sort each statement.

Assumptions are where reports fail: one that proves false silently invalidates every judgment built on it. ISO/IEC 17025:2017 clause 7.8.7 requires opinions and interpretations to be clearly identified with their basis documented; beginning paragraphs with "Observation" or "Opinion" makes the split visible.

The ENFSI Guideline for Evaluative Reporting in Forensic Science (2015) distinguishes technical reporting (findings without evaluation), investigative reporting (explanations offered before competing propositions can be framed, typically early: "consistent with a deposit address at a custodial service") and evaluative reporting (findings assessed against at least one pair of competing propositions, usually one from each party), which a court normally needs at trial.

Words need a declared scale

In his 1964 essay Words of Estimative Probability, Sherman Kent described a 1951 estimate that called an attack a "serious possibility"; colleagues who had approved it meant odds from about 20% to 80%. Tracing reports drift the same way: "suggests", "indicates", "may", "could" and "appears" are almost meaningless. The fix is a published scale of terms tied to numeric ranges, plus a separate confidence statement. Two widely cited scales are examples of practice, not binding rules: US Intelligence Community Directive 203 (ICD 203, Analytic Standards, January 2015) and the UK Professional Head of Intelligence Assessment (PHIA) probability yardstick (republished March 2025).

Neither scale reaches 0% or 100%: certainties are stated as facts. The scales disagree at the edges and PHIA leaves gaps, and ICD 203's two equivalent term sets should not be mixed. Pick one scale, print it in the methods section and use only its terms.

Confidence is not probability. Likelihood says how probable a judgment is; confidence says how solid its basis is, so "likely" can come with low confidence and "roughly even chance" with high. PHIA rates confidence high, moderate or low from the information base, analytical rigor and the subject's complexity and volatility; ICD 203 adds a rule worth copying: state confidence and likelihood in separate sentences. On chain, confidence depends on data provenance, method reliability, independence of evidence (two agreeing methods beat one method run twice), label quality, and whether competing hypotheses still stand.

Strength of support: the court's question

In court, the probability that "this wallet belongs to the defendant" depends on all the evidence, much of which the expert has not seen. The forensic answer is to report the strength of support the findings give to one proposition over another. ENFSI requires balance (at least two propositions), logic (the probability of the findings given each proposition, not of the propositions given the findings), robustness and transparency. Its illustrative verbal scale rests on the likelihood ratio (LR), how many times more probable the findings are under one proposition than the other:

Few tracing heuristics come with numeric ratios, so most reports use these terms verbally with stated reasons; what matters is the logic. Suppose an amount-and-time match found one candidate bridge release in a window that, by chance, would contain such a match about once in 100 comparable windows, while a genuinely related release would almost always match. The LR is roughly 100, on the boundary between moderate and moderately strong support. The correct statement is "if the release were unrelated to the deposit, a match this close would be expected about once in 100 windows". Writing "there is only a 1% chance the release is unrelated" is the transposed conditional, or prosecutor's fallacy: it turns a probability of the findings into a probability of the proposition. Never mix intelligence terms and support terms in the same report.

Uncertainty compounds

If four successive change-detection calls are each about 90% reliable and treated as independent, all four are right with probability 0.9^4 ≈ 0.66: the end-to-end claim is "likely", though every step was "very likely". Real errors are rarely independent, so this shows direction, not a formula. State likelihood for the end-to-end claim, not only for each hop: the path takes the A–D grade of its weakest link (Lesson 3.2), and its likelihood can be lower still. Seek corroboration that skips the chain. For amount-time matches, count candidates in a recorded window and fee tolerance: five candidates mean a baseline of roughly one in five before other evidence.

Writing findings

A reliable pattern is claim, evidence, reasoning, confidence:

Finding 3. Funds reached Exchange K. Between Bitcoin blocks 941,203 and 941,219, three outputs of the peel chain, totaling 2.95 BTC, were paid to bc1q…k8p0, bc1q…2rtd and bc1q…v9ae (Appendix A, rows 14–16). Each address was later spent in a sweep with more than 100 other addresses into a hot wallet on a reserve address list published by Exchange K itself (rows 21–22). By the common-input heuristic and the sweep pattern, we assess that these are very likely Exchange K deposit addresses. We have moderate confidence in this judgment because the path relies on change detection across several hops; Exchange K's own records would settle it.

It gives block ranges and appendix rows, names the method, uses a declared term, states confidence separately and says what would resolve the doubt. In a forensic report the same finding is labeled opinion, names the competing proposition and uses the support scale. Write in active voice; give numbers with units, rounded in text and exact in the appendix; define each technical term once; keep one term, one meaning; and let no adjective ("suspicious", "clearly") do the work of evidence. Keeping each finding as a structured record, from which text and appendices are generated, means a limitation cannot be dropped unnoticed:

{
  "finding_id": "F3",
  "question": 2,
  "type": "opinion",
  "statement": "bc1q…k8p0 is a deposit address of Exchange K",
  "propositions": ["deposit address of Exchange K", "address unrelated to Exchange K"],
  "basis": ["appendix_A_rows_14_16", "appendix_A_rows_21_22", "exchange_k_published_reserve_list_2026-03-20"],
  "method": "sweep pattern and common-input heuristic, CoinJoin and PayJoin excluded",
  "support": "strong support for the first proposition",
  "limitations": ["path relies on change detection over 4 hops"],
  "tools": [{"name": "examiner graph tool", "version": "4.2.1"}],
  "data_cutoff": {"bitcoin_block": 941350}
}

Limitations

Typical on-chain limitations: coverage (chains, tokens or layers out of scope); cut-off (funds may have moved after the stated block); heuristics and their failure modes, such as CoinJoin breaking the common-input heuristic; labels, with sources, dates and whether checked; off-chain gaps, since custodial ledgers are invisible without legal process; and absence of evidence.

Appendices and reproducibility

The core appendix is a transaction table: one row per transaction relied on, with chain, full transaction hash, block height, block hash (proving which version of the chain was read), UTC time, sender, recipient, asset, amount and finding. Shortened identifiers are fine in the body, but truncated hashes in an appendix cannot be checked. Generate the table by a query that joins the case's citation list to transactions and blocks, so it cannot drift from the data; add an address table (address, role, label, label source and date), the versioned queries, flow charts and timelines (Lesson 9.3) and the evidence package for re-performance (Lesson 8.2). Record what a second examiner needs to reach the same numbers: data source and version, finality depth, query commit, label set and date, and the price source and method for fiat values.

Declaration, amendments and review

The declaration typically states that the expert understands and has complied with the duty to the court, that the opinions are their own and within their expertise, that all relevant matters are mentioned, including those that detract from the opinions, that conflicts are disclosed, and that the court will be told if the opinion changes (Lesson 9.1).

An issued report is never silently edited. ISO/IEC 17025:2017 clause 7.8.8 requires changes to be clearly identified, with the reason where appropriate, and a replacement report to be uniquely identified and reference the original. Amendments are common in crypto cases because exchange records arrive late or funds move after the cut-off; each states what changed, why and which conclusions are affected, so the court sees the opinion moved because of evidence, not pressure. Analytical reports keep a version number and change log.

Before release, a reviewer checks that conclusions match findings and findings match the appendix, re-verifies a sample of cited transactions against a node, confirms the declared scale is used with confidence stated separately, argues for the main alternative, checks figures for observed versus inferred links, and runs a privacy pass (Lesson 1.5).

Exam focus: expect to identify what a forensic report adds to an analytical one and the eight-part structure, with SWGDE minimums and the ISO/IEC 17025 clauses on opinions and amendments. Be ready to classify statements as fact, inference, assumption or judgment; explain Kent's example, the ICD 203 and PHIA yardsticks, one declared scale and confidence in a separate sentence; distinguish technical, investigative and evaluative reporting, ENFSI's four requirements and the likelihood-ratio scale; spot the transposed conditional; compute compounding uncertainty (0.9^4 ≈ 0.66); and recognize sound findings, limitations and appendices with block hashes and full identifiers.