What a report must contain

For most people involved in a case, the report is the examination. Judges, lawyers, managers and other examiners will rarely open a forensic image; they read what the examiner wrote about it. A sound examination with a weak report can fail, because nobody can tell what was done or how far to trust the result. This lesson describes what a forensic report contains and why each part is there. Lesson 7.2 covers limitations and Lesson 7.3 covers writing for readers who are not specialists. The notes kept during the work, which support the report, are covered in Module 5.

What a report is for

A forensic report communicates findings so that others can understand them, check them and rely on them. Each of those verbs points to a different reader.

• Understand: the person who must decide, such as a judge, a tribunal or a manager, needs clear answers to the questions that were asked.
• Check: a reviewer or an examiner instructed by the other side needs enough detail to test the method and repeat the work.
• Rely: everyone needs to know what the findings are based on and where their limits lie, so that a decision does not rest on more than the evidence supports.

ISO/IEC 27042, the standard on the analysis and interpretation of digital evidence (Module 1), is the usual international reference for reporting that work. In general terms, it expects a report to make clear what was examined, how, what was found, and how each conclusion follows from the findings. Laboratories accredited to ISO/IEC 17025 must also meet that standard's requirements for reporting results.

The typical structure

Report formats differ between organizations and countries, but most contain the same building blocks, usually in this order.

Facts, inferences and opinions

A reader must be able to tell what the examiner observed from what the examiner concluded. Three kinds of statement should be kept apart and worded so that the difference shows.

• Fact (observation): what the data contains, which anyone with the same image can verify. "The SYSTEM registry hive on Item 1.1 contains an entry for a USB storage device with serial number 0A1B2C."
• Inference: a conclusion reached by reasoning from facts. "That device was connected to the laptop on 4 March 2026."
• Opinion: the examiner's evaluation, based on expertise, of what the findings mean for the questions, for example how strongly they support one explanation over another.

Many legal systems allow an expert to give opinions that ordinary witnesses cannot, but only within the expert's field and with the basis stated. An opinion without its basis is of little use to a reader who must weigh it.

Reproducibility: enough detail to repeat the work

Module 1 defined reproducibility: another examiner, using the same method, obtains the same result. A report makes this possible only if it records:

• the hash values of each item and image, so that a second examiner can confirm they hold the same data;
• the name and exact version of each tool, because parsing behavior and known errors change between releases;
• settings that affect results, such as the time zone used to display timestamps (Module 6);
• the precise location of each finding: file path, registry key, database table or record number;
• how deleted or hidden data was recovered, and how key results were checked, for example with a second tool or by manual inspection.

A report does not need to list every click. The contemporaneous notes hold that level of detail (Module 5) and can be disclosed if a reviewer asks for them.

Conclusions that answer the questions

Every question in the instructions should receive an answer, in the same order and with the same numbering, even when the answer is "this could not be determined". Conclusions introduce nothing new: each one should be traceable to findings set out earlier. Exculpatory findings belong in the conclusions as clearly as inculpatory ones (Module 1). If a report is later corrected or extended, a new version or a supplementary report is issued and the changes are stated, rather than silently replacing the earlier text.

A worked example: USB data theft

Nordvale Engineering suspects that an engineer copied design files before resigning. The examiner's report is outlined below.

1. Identification: report NV-2026-014, version 1.0; examiner's name and qualifications; instructions received 10 March 2026; examination 11 to 18 March; report dated 20 March.
2. Questions: Q1, was a USB storage device connected to laptop NV-LT-0193 between 1 and 15 March 2026? Q2, were files from the Hydra project folder transferred to such a device? Q3, which user account was in use at the time?
3. Items: Item 1, the laptop with its serial number; Item 1.1, its forensic image with the SHA-256 value recorded at acquisition and verification; Item 2, an export of the file server's access logs with its own hash value.
4. Methods: imaging through a write blocker; tools named with exact versions; all times shown in UTC.
5. Findings: device records in the SYSTEM hive and in setupapi.dev.log; shortcut (LNK) files showing that files with the same names as Hydra files were opened from the device's volume (Module 6).
6. Interpretation: the findings support transfer to the device; an automatic backup was considered and ruled out, because no backup software was configured.
7. Limitations: the USB device was not available, so its contents could not be confirmed; the findings identify an account, not a person.
8. Conclusions: answers to Q1, Q2 and Q3, each referring to the findings.
9. Appendices: event timeline, list of USB devices, glossary.

Exam focus: Know the sections of a forensic report and what each answers, especially items received with IDs and hash values, tools with exact versions, and conclusions that answer every question. Be able to tell facts from inferences from opinions, and explain what detail makes a report reproducible. Remember ISO/IEC 27042 as the reference for reporting analysis and interpretation, and that conclusions must be traceable to findings.