Mobile Forensics · Reporting & Ethics · Lesson 2 of 5

Writing a Forensic Report

See what goes in an exam report and how to write it for non-experts.

What goes in the report

An examination can be flawless and still fail if nobody can understand or check it. The forensic report is the document that tells others what was examined, how, and what was found. It may be read by a detective, a lawyer, a judge, a jury or an HR manager, and most of them won't be technical.

Two widely used references describe what belongs in it: NIST SP 800-101 Rev. 1 (its chapter on reporting) and SWGDE's Requirements for Report Writing in Digital and Multimedia Forensics (version 1.0, 2018). SWGDE is the Scientific Working Group on Digital Evidence, a US group of practitioners that publishes best practices. Drawing on both, plus common lab practice, a solid report covers:

• Who and when. The examining organization, a case number, the examiner's name and signature, and the report date.
• Request, scope and authority. What was asked for, and what allowed the exam, such as consent, a search warrant or a contract.
• The items. Each phone or extraction, identified by make, model, serial number and hash value.
• Tools and methods. The equipment and software used, with version numbers (tools change between releases), and the steps taken, such as the type of acquisition and the searches run.
• Findings. What was recovered, in plain terms, with supporting material such as screenshots or exported records.
• Limitations. What couldn't be done or seen, for example a locked area, an app the tool couldn't decode, or a phone model the tool doesn't support.
• Disposition. What happened to the original evidence and any copies (returned, kept or destroyed).

Most forensic tools can print their own report at the click of a button. SWGDE points out that these describe the tool's own actions and results, but don't usually document the full scope of the examination. So a tool report is normally attached as supporting material or an appendix. The examiner still writes the examination report and is responsible for it.

Facts, opinions and repeatable work

SWGDE says results must be described in terms clear enough for a layperson (someone with no technical training) to understand. That means short sentences, defined terms and concrete examples. Instead of "artifact parsed from table message, row 4412", write "a text message stored in the phone's messages database", and put the technical detail in an appendix.

The most important habit is keeping facts apart from interpretation.

• A fact is what the data shows: "The messages database contains a message from the contact saved as Sam, timestamped 14 March, 21:04 UTC."
• An interpretation is what you think it means: "The phone's owner read Sam's message that evening."

The second sentence claims much more. Who was holding the phone? Was the message opened, or only shown as a notification? Was the clock right? Interpretations can be useful, but they should be clearly labeled as opinions. SWGDE says that if a report includes opinions or conclusions, it should document each opinion and its basis. Careful phrases like "consistent with" exist for this reason. They say the data fits an explanation without claiming it's the only one.

Reproducibility is the other pillar. NIST and SWGDE both note that tools and methods can be challenged in court, and that good documentation lets someone else repeat the process and check the results. That's why reports record tool versions, settings, hash values and the order of steps. NIST even suggests keeping a copy of any custom software used, in case the results need to be reproduced.

Mistakes happen. If one turns up after the report is final, it isn't quietly fixed in the original file. SWGDE says a new report is released with the edits identified and explained, and it must reference the original report.