Documentation and reporting are often used interchangeably, but are they the same?
Not really. In fact, they each serve a completely different purpose.
Documentation is for the experts (future you, a peer reviewer, another forensic examiner). Reporting is for everyone else. In this guide, we'll break down the purpose of each and what to include (or exclude) in your forensic documentation and reports.
Let's start with reports.
What’s the purpose of a forensic report?
Think of your report as an API for your forensic analysis. It exists to communicate your findings clearly in an objective manner to people that can rely on our expertise to make a decision. Because of that, your goal as the report writer is to distill your complicated analysis into something that is easy for other people to consume, without getting into the weeds of digital forensics.
Who is the audience?
When you're doing your forensics report, thinking about your audience is really important. For example, doing forensic analysis in a criminal case for a prosecutor is a bit different than in a civil case for a litigator: the standard of evidence is different, the litigator's strategy will be different from a prosecutor's.
Whoever the audience is, basically what they're looking for is that they want to give you something to analyze, and what they want back is a set of results that they can take action on.
In my experience, my findings and reports in civil cases have been a lot more complicated and technical. This is because in civil cases sometimes really small things matter and it gives the litigator a lot of things to make arguments around. In criminal cases, a lot of times the crime is fairly black and white, so the evidence either has to show something happened or that it didn't. In reconciliation cases, there's a lot more room for interpretation, so the analysis can be a bit more complex.
Thinking about the audience can add to your strategy for how to structure the report. So take some time to consider who the audience is and how much complexity they will be able to digest.
Tailor complexity & language to the audience
A good approach is to adjust the technical depth of your report based on who else will be reading it.
Technical audiences
For example, another forensic examiner doing peer review or on a case with an opposing forensics expert. Technical audiences will expect details on your methodologies and tools, so these reports are usually a bit more complex and in-depth on what you did and how you did it.
Non-technical audiences
This could be judges and juries, legal counsel / attorneys, corporate executives / management, insurance adjusters. These audiences are relying on your forensic expertise to help them do their job and take action, so use plain language, analogies, and visual aids (like screenshots or diagrams) to help clearly illustrate your findings.
Consider multiple versions
You may want to consider creating multiple versions of your report. Start with a basic version tailored to the primary audience, and include an executive summary and a technical appendix. You can always write another report or a supplemental one that adds that technical complexity if needed.
Signs of a bad forensic report
I've probably written a thousand forensic reports in my career. Below are a few things I've figured out from looking at my own forensic reports from before I really honed in on the process of what makes an effective forensic report.
What to avoid
Too much time reporting about hashes. Don't spend a lot of time talking about the hashing process, put that in your documentation instead. Spending the first two or three pages of your report on hashes makes your report less effective and hinders your ability to illustrate the findings that are actually important in your analysis.
Talking about forensic tools too much. Avoid mentioning your forensic tools too often. It's okay to have a section where you generally list the forensic tools used in the case, but over-referencing tool names in your narrative creates the impression that you're just reporting on what the software showed you, rather than real forensic expertise. This also applies to expert testimony.
Discussing the imaging process. This is not needed in the forensic report. Imaging and extraction are fairly standardized now, and most of those tools are self-documenting through logs. Instead, document the process in your notes (more on this later).
Lack of formatting. A report with no section headers or headings, no titles or sections, no paragraph spacing is difficult to read. Nobody wants to read a waterfall of text in a Word document. Using white space, titles and headers, executive summaries, and sections makes the report easier to read. If your report is longer than 5 pages, you should also include a table of contents to help make it easier to navigate the report.
Using a tool export as your entire report. If the report is just an export from your tool of choice, it’s really just an exhibit. It needs the context of your analysis to convey why it’s important. Attach relevant tool exports as an appendix and just reference them where appropriate in the report.
Structure and strategy
These guidelines are really more about the mechanics of the report itself, how to create it and set it up.
Keep it simple. It's okay to be complex at first, but always try to simplify things if you can, especially if the report is for a non-technical or a non-forensic person. The more complicated the report is, the harder it's going to be for the reader to get any value out of the report.
Use moderately sized paragraphs. Keep paragraphs under 5 sentences, and be judicious in how you structure paragraphs. Use lots of white space so the audience can read a paragraph and digest the complete thought.
Split the report into sections. Take your analysis and try to break it up into general thoughts and ideas, then use sections, headers, subheaders and titles to split those sections up. This gives the reader a way to split up your report mentally and digest it appropriately.
Create an executive summary. If the report's fairly simple, this may not be needed, but I always encourage some kind of 1 to 2 page executive summary. The idea is that the reader can read your summary and within a few minutes be able to understand exactly what the report is about. That means they can read it, digest what you're giving them and make quick decisions based on the report that you provided.
Use white space.The more white space the better. It makes the report easier to digest and easier to read.
Use sans serif fonts. These are fonts that don't have little extra flares on the letters called serifs. Serifs add a lot of textual noise on digital displays, which is what most people are going to read your report on. Sans serif fonts like Arial, Helvetica, Inter and Segoe UI don't have those little flares, which makes them easier to read than serif fonts like Times New Roman. This also helps add that white space concept to the report and makes it easier to read.
Example report structure
This is a report structure I've found to be effective:
- Cover Page
- Table of Contents
- Report Summary Page (about 1 or 2 pages)
- Case Background
- Summarized findings
- Brief Evidence List
- Any other brief details appropriate for the summary
- Detailed Narrative/Analysis
- Analysis Sections
- Screenshots
- References to external Exhibits or attachments
- Footnotes
- Only state enough to support findings
- Optional Sections
- You can add custom sections to illustrate other types of information
- Summary of people involved (witnesses, custodians, subjects, etc.)
- Summary of Forensic Tools and equipment used with details
- Glossary of terms and definitions referenced in the report
- Any other non-analysis data or information that is useful to the reader
- Conclusion (Optional)
- This may be redundant to what’s already in the case summary
- It’s likely not necessary unless you want to add a detailed conclusion
- Attachments/Exhibits
- Includes supporting docs with appropriate labeling (Ex.A, Ex.B, etc.)
- Includes a copy of your CV/Resume
- You may also reference digital exhibits here as well (UFED reports or other portable case viewers/data)
Are LLMs (ChatGPT, Claude, etc) useful in report writing?
Absolutely, but use with caution. Do not use them to write your report.
Instead, think of them as a writing assistant that can help you clarify concepts and iterate. Start with the basic idea of what you want to describe or illustrate, then ask the LLM to assist with clarity and brevity. You can also ask it to give you examples of how to describe something and use it for inspiration.
Again, make sure you are doing the actual writing. LLMs are verbose, which can lead to a report style that is flowery, repetitive and soulless.
Note: If you are using an LLM as a writing assistant, do not feed any real data or details from your case into the LLM. You don't want to inadvertently give it access to sensitive case details.
Now let’s move on to documentation.
What is the purpose of documentation?
Documentation is for you and other forensic experts to make notes of your methods, process, analysis and anything else that would be useful.
So how detailed should your documentation be? A good way to think about it is to document enough details that you can reverse engineer how you did your work.
From there, you have the freedom to decide how you want to go about it: you can document anything you want, using whatever tool you prefer. And if you work on a lot of cases or projects throughout the year, good documentation can save your bacon!
What to include in forensic documentation
Documentation is more flexible than reporting, but there are still some good practices to follow.
Use a system that has rich text and screenshotting. Rich text (meaning text that can be formatted) and screenshot support can help you better document your analysis, methods and procedures in a way that’s easy to understand. A system like, say, our free Monolith Notes tool.
Document when and how you did something. This applies to forensic imaging, processing, analysis. It establishes your methodology and what order you did things in.
Use a system that allows you to export your notes. This makes it easier to send on to others or append them to your report if needed later. Our Monolith Notes tool, for example, can export PDFs of notes for easy sharing.
The earlier rules for reporting don’t really apply to documentation. Just take notes in a way that makes it easy for you to document.
Taking notes and documenting consistently can make reporting easier. If your notes are consistent and detailed, it makes your reporting more efficient because you can use your notes to help you write the report. It also means you can write a report months or years after the work has been completed. You just reference your notes and build your report from there.
What about discoverability?
Some people worry about discoverability, but I don't. Just take your notes as you need them. They're for you. They're yours to help you with historical review of your analysis and help you with basically your own work. So I would not limit that by worrying about whether someone in court gets to see your notes or not.
Conclusion
Documentation is not the same as reporting, though both are important parts of the forensic process.
Treat documentation as for you and other experts. It’s a way to note your methodologies so you can reverse-engineer how you did the work, which will make your reporting more efficient and easier to write later. If you’re looking for a tool to use for your documentation/case notes, check out our Monolith Notes app on our free tools page.
Reporting is for the non-technical or non-forensics audience that is using your report to do their job or take an action based on the report you provided. Distill your complicated analysis into something that’s easy for others to consume. Keep it simple, tailor it to your audience, and use formatting and white space to make it easier to read.
One of our Workshop Wednesday presentations goes into more detail on this topic, you can watch the recording below.