Forensic Report

Report Structure

The forensic report should contain:

• Preamble – pages with roman numeration.

  • Declaration of honor – sometimes it’s a separate document.

  • List of acronyms in alphabetical order.

  • List of contents.

• Body – start the Arabic numeration of the pages.

  • Introduction.

  • Several analysis chapters, usually one per device.

  • Conclusions.

• Epilogue.

  • Bibliography – not always required.

  • Appendixes – not always required.

  • Glossary – recommended.

• Declaration of honor.

  • usually, it’s a separate document.

  • but can be included in the report.

• Introduction.

  • what are you looking for and why?

  • list of the devices being analyzed and their IDs.

  • explain the structure of the report.

• Analysis.

  • one chapter per analysis, e. g. for each device, DNS analysis, etc.

  • for each chapter:

    • detail the device characteristics and ID.

    • the procedures you made on that device, e. g. forensic copy, run anti-virus, etc.

    • explain clearly what you found.

    • anti-virus results.

• Conclusions.

  • reconstruct the events based on the evidence found.

    • and include a reference to the chapter and section in the report where you detailed how you found the evidence.

  • report all the found evidence, either incriminating or exculpatory.

  • always use clear text and avoid complex technical terms when possible, and if needed reference to a glossary explaining the technical terms.

• Bibliography.

  • citations help to increase the credibility of the report and the expert.

  • cite reference books in the field, or another medium with a high reputation in the field being analyzed, e. g. RFC.

  • there are many bibliography styles, e. g. APA, Chicago, IEEE, Harvard, ...

    • choose one and be consistent throughout the report.

    • use tools to help format the references, e. g. JabRef, Mendeley, MS Word Reference tool.

• Appendices.

  • The Appendices section should be used to include information that helps to demonstrate or complements, the expert conclusions.

  • Include documents relevant to the case being analyzed:

    • reports generated by used tools.

    • technical specifications from hardware vendors.

    • reports, or parts of a report, produced by someone else.

• Glossary.

  • explain technical terms in lay language.

  • this section is important for the non-technical staff that must read the report.

Phishing - Phishing is the attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money), often for malicious reasons, by masquerading as a trustworthy entity in an electronic communication. The word is a neologism created as a homophone of fishing due to the similarity of using a bait in an attempt to catch a victim. Phishing is typically carried out by email spoofing or instant messaging, and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one.