Reporting findings at a technical level in digital forensics: A guide to reporting

One of the primary roles of a practitioner in the field of digital forensics is to conduct the examination of any lawfully seized digital device content, and report upon any findings which may support any inquiry being conducted. Whilst there are many intricacies to this task, often an inquiry will commence with a practitioner carrying out the necessary examination work required to report any findings at a ‘technical level’. Technical reports are often used for intelligence gathering purposes in an attempt to establish the potential evidential value of a device, and are often a precursor to, and catalyst for, further and often more extensive forensic work being commissioned. Therefore, the ability to report at a technical level should arguably be considered a fundamental skill required of all practitioners in this discipline, however, there is limited formal and available guidance for how to conduct this task effectively. This work explores the fundamental role of technical reporting, where a series of reporting examples are presented which explore the intricacies involved with conveying DF findings at a technical level. Procedural and linguistic challenges are investigated and evaluated in order to suggest both the pitfalls that practitioners may encounter and potential technical reporting best practices.