Analyzing Data and Writing Reports

Abstract

This chapter describes the actual examination process and the general demands for a forensic examination. A basic rule is that the results presented in a forensic examination must be objective and true. Digital forensics is comparable to academic work in this manner. This chapter discusses key concepts used to ensure that the results of a forensic examination meet those demands and discusses the concepts of being unbiased and producing reproducible results. The final target of any examination is to provide answers to some question or request. This chapter ends with a discussion on reporting and includes a scale that can be used to grade the strength of the conclusions drawn during the examination. As it is of great importance that a forensic report is interpreted the same way no matter who the reader is, using a common scale is of great help. Further, this chapter aims to provide the reader with an understanding of the key elements in the forensic process.