Chapter 26 — Exercises

A mix of concept checks, judgment calls, and hands-on writing labs — because reporting is a writing skill, most of the hands-on work here is "write the finding," "render this at three layers," "calculate and verify the hash," and "write the report," not "run this tool." Groups A–G follow the arc of the chapter: what a report is and the several kinds you write → its anatomy and ordering → writing for three readers at once → the interpretive ladder of fact, inference, and opinion → what to leave out and the discipline of negative findings → building a single defensible finding and the report around it → review, reproducibility, and the progressive-project milestone. Do the writing exercises in prose you would be willing to read aloud on the stand: concrete, plain, tied to an exhibit, and qualified to exactly what the evidence shows. (answer in Appendix) marks problems with a worked solution in Answers to Selected Exercises. ⭐ marks a stretch problem. Section templates for every part of a report live in Appendix F.

Group A — What a report is, and the kinds you write

26.1 In one sentence, define a forensic report so that your definition contains the reproducibility standard — i.e., it names the independent examiner who must be able to understand, evaluate, and reproduce the work. Then list the three things that definition deliberately excludes (it is not a narrative of your adventure, not a transcript of every command, not an argument for one side), and explain in two sentences why each exclusion protects your credibility. (answer in Appendix)

26.2 Build a comparison table of the report types in this chapter — report of examination, expert report, affidavit/declaration, incident-response report, recovery report — with one column for primary audience, one for legal weight, and one for the rule or statute (if any) that governs its form. Populate the rule/statute column correctly where one applies (think Federal Rule of Civil Procedure 26(a)(2)(B); 28 U.S.C. §1746). Then state in one sentence the single trait all five share. (answer in Appendix)

26.3 ⭐ A litigator retains you as a testifying expert in a federal civil matter and asks for "the usual report." List the six categories of content FRCP 26(a)(2)(B) requires beyond a plain report of examination, and for each give a one-line example of what you would actually write. Then explain the specific, severe consequence of forgetting to disclose one of your opinions in this report — and why that makes the expert report the most unforgiving document you will produce.

26.4 A new colleague says, "Recovery reports and forensic reports are basically the same document." Using the chapter's Recovery vs. Forensics distinction, write a four-sentence rebuttal that (a) names the different question each answers, (b) names two things the forensic report carries that the recovery report does not, (c) names the one virtue they share, and (d) states the practical rule about writing recovery reports as if they might become evidence.

Group B — The anatomy and its ordering

26.5 List the eight standard sections of a forensic report in order, from the title/case-identification block through the appendices. For each, give a five-word-or-less statement of its job. Then explain the inverted-pyramid ordering — why the most important findings appear early and the densest technical proof appears late — and name which of the three readers is served by the front matter and which by the back matter. (answer in Appendix)

26.6 Write a complete evidence-inventory entry for the following item, in the chapter's style, precise enough that no one could confuse it with any other device on earth: a Dell Latitude 5420 laptop, service tag/serial 7F2X9Q3, containing one internal Samsung MZVLB256HBHQ NVMe SSD, serial S3TPNX0M412345, 256,060,514,304 bytes; received sealed in tamper-evident bag SB-4471; imaged 2026-06-25 to compressed E01 with Guymager 0.8.13 through a Tableau T7u write-blocker; MD5 9a1c0e6b4f7d2a83c5e10f9b6d4a72e8, SHA-256 4e1d…c8e, source-equals-image verified. Then state in one sentence why the two hashes belong in the inventory rather than only in an appendix.

26.7 Here is a draft executive summary. Critique and rewrite it.

EXECUTIVE SUMMARY: Forensic examination of the subject's NTFS volume
recovered twelve files from unallocated clusters via TSK fls/icat after
the MFT $DATA non-resident runs were enumerated; the $STANDARD_INFORMATION
timestamps and the USB device's volume serial in the SYSTEM hive prove the
defendant knowingly exfiltrated the proprietary dataset to removable media.

(a) Identify every place this "summary" fails its audience — jargon a judge cannot parse, and a conclusion that overreaches. (b) Rewrite it as a true executive summary: one short paragraph, plain language, no byte-level jargon, stating what you were asked and what you found without overstating. (c) Explain why the chapter insists the executive summary be written last and read first.

26.8 ⭐ For a corporate matter on a company-owned laptop with a signed acceptable-use policy and a login banner consenting to monitoring, write the report's two-part authority and scope statement: an authority sentence (why you were allowed to look) and a scope statement (what you were asked to determine and what you deliberately did not examine). Then explain, in two sentences, how the scope statement specifically defends you against the accusation that you ranged beyond your authorization — and why "out of scope: the user's personal cloud accounts and personal devices not present on this image" is a sentence that protects both you and the subject.

Group C — Writing for three readers at once

26.9 Take this single finding and render it at the three layers the chapter describes — executive summary (for the attorney/decision-maker), findings body (for the lay reader/jury, terms defined), and methodology/appendix (for the opposing expert, fully reproducible): "A spreadsheet matching the company's proprietary dataset was recovered from space the system had marked reusable after the file was deleted; file-system metadata records its last access on 2026-06-18." Use plausible specifics for the appendix layer (an MFT entry number, a data-run starting cluster and byte offset, a SHA-256 fragment, an exhibit reference). (answer in Appendix)

26.10 Map each Federal Rule of Evidence to the layer of the report it most directly supports, and explain the match in one sentence each: FRE 702, FRE 703 and 705, FRE 1006. Then state the larger point the chapter draws from this mapping — that the report's structure is not arbitrary stylistic taste but a mirror of the rules under which the report will be used.

26.11 The chapter offers one good analogy for unallocated space ("a room where the furniture was thrown out but the dents in the carpet remain") and warns against one bad one ("the computer remembers everything forever"). (a) Explain precisely why the first illuminates deleted ≠ destroyed without misleading, while the second invites an impeaching cross-examination. (b) Write one new plain-language analogy for a concept of your choice from an earlier chapter (a hash, file slack, a write-blocker, the MFT) that is accurate enough to survive cross-examination, and then state the one way a hostile expert might still attack it.

Group D — The interpretive ladder: facts, inferences, opinions

26.12 Classify each of the following statements as DATA, FACT/OBSERVATION, INFERENCE, or OPINION, and for any you rate above "fact," name the additional facts that statement must rest on to be defensible: (a) "MFT entry 41902 records a $FILE_NAME creation timestamp of 2026-06-18T21:14:07Z." (b) "The file was opened from removable volume E: on the evening of 2026-06-18." (c) "The pattern of access is consistent with deliberate copying rather than automated synchronization." (d) "The bytes at offset 15,602,225,152 are the recovered file's first data run." (e) "The user intended to take the dataset to a competitor." (answer in Appendix)

26.13 The single most dangerous collapse of the ladder is conflating the account with the person. (a) Rewrite the sentence "The suspect created the file patients_q3.csv on the laptop" into a defensible fact statement and, separately, a defensible qualified opinion statement. (b) List three concrete alternative explanations for activity under a user account that the forensic evidence alone cannot exclude. (c) Explain in one sentence why giving the defense this distinction yourself, in writing, is stronger than letting them extract it on cross-examination.

26.14 ⭐ A matching acquisition hash is the strongest claim in your report — and one of the most over-claimed. State precisely what a matching hash proves, then list at least four things it does not prove (think authorship, origin, the time content first existed, ownership of a device, intent). For each non-proof, give a one-line example of a finding that would be needed to establish that thing instead — and note which other chapter owns that artifact (e.g., timeline → Chapter 21, USB device history → Chapter 16).

Group E — What to leave out, and the discipline of negative findings

26.15 The following paragraph from a draft report contains all three categories that must stay out of a forensic report. Identify each category, quote the offending words, and rewrite the paragraph so it states only what the evidence shows. (answer in Appendix)

The user clearly knew the files were there and maliciously hid them in a
folder named "WinSysCache" to evade detection. This deliberate concealment
proves the defendant is guilty of trade-secret theft, and the company is
obviously entitled to damages.

26.16 Document negative findings for the following examination. You searched the image for (a) anti-forensic / disk-wiping tools, (b) malware or remote-access tooling that could account for a file's presence, and (c) evidence of an automated cloud-sync process — and found none of the three. Write each as a proper negative finding (not a non-event), and then explain, for each, how the negative result either strengthens or weakens a conclusion of deliberate user action — and why you were obligated to look and report regardless of which way it cut.

26.17 ⭐ In the courtroom anchor case, your loyalty is to the facts, not to the side that retained you. Without describing any content, list the exculpatory possibilities an impartial examiner must pursue and report with the same rigor as the inculpatory ones — e.g., automatic download, a cached web page, a malware payload, a synced account, background-process timestamps versus knowing access. Then explain in two sentences why "the method that convicts the guilty is the method that clears the innocent," and where the chapter says this duty is owned in depth (Chapter 28).

Group F — Build a defensible finding and the report (hands-on)

26.18 Fill out the chapter's four-part Finding for the following artifact set, then render it as the boxed prose finding that would appear in the report body (observation → supporting artifacts → interpretation → limitation): A JPEG was recovered by carving from unallocated space on Item 01 at byte offset 48,213,008,384; its header bytes are FF D8 FF E1 and footer FF D9; its SHA-256 (e2b1…a90c) matches an entry in the Project VIC known-image hash set; an EXIF DateTimeOriginal field is present; the file-system last-access date is 2026-06-12. Identification is by hash match — the file was not visually reviewed. Keep every claim tied to a coordinate (offset, signature, hash, exhibit) and keep the limitation honest about what the finding does not establish. (answer in Appendix)

26.19 Calculate and verify the hash — spot the drift. Your inventory records the acquisition SHA-256 of Item 01 as 4e1d8b9a6c0f23e7d5a1b4c8f02e96d3a7b5c1e0f8d2a4b6c9e3f1a07d5b2c8e. Three places in the draft cite it; here are the citations:

[Inventory]    SHA-256: 4e1d8b9a6c0f23e7d5a1b4c8f02e96d3a7b5c1e0f8d2a4b6c9e3f1a07d5b2c8e
[Methodology]  ...verified against acquisition SHA-256 4e1d8b9a6c0f23e7d5a1b4c8f02e96d3a7b5c1e0f8d2a4b6c9e3f1a07d5b2c8e
[Finding F-003] ...source image, SHA-256 4e1d8b9a6c0f23e7d5a1b4c8f02e96d3a7b5c1e0f8d2a4b6c9e3f1a07d5b2c8c

(a) Find the discrepancy. (b) Explain why a one-character difference, even an obvious typo, is "a cross-examination gift." (c) State the process habit from the chapter that prevents this class of error entirely, and write the one hashdeep command you would run to generate the exhibit hash appendix mechanically so the numbers cannot drift.

26.20 Build the timeline finding without repeating the War Story. The chapter's War Story describes an examiner who reported a file was "accessed" at a time that was actually a modified timestamp written by a backup agent — a MACB confusion (see Chapter 21). Given a $STANDARD_INFORMATION modified time of 2026-06-18T03:00:11Z and a separate logged event showing a backup agent ran at 03:00, write the correct, defensible finding about this timestamp: state precisely what it shows, what it does not show, and the honest interpretation. Then write the one sentence you would put in the limitations section to pre-empt the cross-examination the War Story examiner walked into. (answer in Appendix)

26.21 Write the report — conclusions and limitations. For the courtroom anchor case (case 2026-0142), and strictly at the level of procedure, metadata, and provenance — never content, draft the conclusions and limitations sections given these inputs: N files on Item 01 match the Project VIC hash set; M of those were recovered from unallocated space (indicating prior deletion); timeline analysis places presence and last-recorded access on stated dates; a search for malware, remote-access tooling, and automated sync found none (a negative finding). Your conclusion must be supported and proportionate (no legal verdict), credit the negative finding, and your limitations section must pre-empt the two questions the defense will press hardest — who was at the keyboard? and could something other than deliberate action explain this?

26.22 ⭐ Same outcome, two reports. A 4 TB external drive was imaged and 18,412 of an estimated 19,000 user files were recovered; the remaining ~3% lay in a physically damaged platter region and are unrecoverable. (a) Write the one-paragraph findings statement as it would appear in a recovery report for the client/insurer. (b) Rewrite the same outcome as it would appear in a forensic report if this drive had instead been evidence in a civil matter — adding what the forensic version requires (integrity statement, chain-of-custody reference, fact-vs-inference discipline, limitation). (c) State the one sentence of the chapter this exercise is meant to drive home about writing recovery reports.

Group G — Review, reproducibility, and the progressive project

26.23 Run the chapter's pre-release review checklist against this report excerpt and list every defect you find, labeling each as a technical or an editorial failure: a finding cites "an EXIF date" with no exhibit reference; the tool is named as "Autopsy" with no version; the executive summary uses "MFT" without defining it; one timestamp is written "6/18/26 9:14 PM" with no timezone; the conclusion states "the defendant is liable for misappropriation"; and there is no statement that anyone other than the author reviewed the report. For each defect, write the corrected version. (answer in Appendix)

26.24 Technical vs. editorial review. The two reviews ask different questions. Sort the following checks into the correct review and add one more check of your own to each list: hashes consistent everywhere; executive summary stands alone; conclusions supported by cited findings; no jargon undefined on first use; tool versions present; negative findings documented; neutral non-pejorative language; key findings independently re-run on the image. Then explain why the chapter calls the technical reviewer "a friendly version of the opposing expert," and why many labs require the reviewer to re-examine key findings rather than merely read about them.

26.25 Language-review pass. Run the chapter's red-flag idea over this paragraph by hand, highlighting every word or phrase that signals a slide from fact into speculation or advocacy, then rewrite each into a defensible statement: "The user obviously knew about the files and clearly must have intended to take them; the timeline proves beyond doubt that the suspect downloaded the dataset and then deliberately deleted it to cover his tracks." For each rewrite, name the artifact you would need to actually cite to support any genuine inference that remains — and state why a script can flag these phrases but never fix them.

26.26 Write a reusable tool-and-version block you could paste into every report and update as you patch your kit, covering at least: imaging tool, write-blocker, analysis suite, carving tool, metadata tool, and timeline tool — each with an exact version and a "last validated against [reference image] on [date]" note. (a) Use real, current-style version strings (e.g., Autopsy 4.21.0 / The Sleuth Kit 4.12.1, PhotoRec 7.2, ExifTool 12.x, Guymager 0.8.13). (b) Name a public reference image you could validate against (see Appendix J). (c) Write the one-sentence answer this block lets you give when opposing counsel asks, "How do you know your carving tool didn't fabricate that file?"

26.27 ⭐ Progressive project — write the court-admissible report. This is the milestone the whole project has been building toward. For Meridian Health Analytics's civil matter concerning the departed data engineer "J. Okafor" and the alleged copying of a proprietary patient-analytics dataset to removable media or personal cloud, write a complete forensic report following this chapter's anatomy on Exhibit MHA-2026-001 (mha-laptop.E01, container SHA-256 b7e0c3f6a9d2b5e8a3f5c9d2b8e14f6079c2d5a8b1e4f7c0d3a6b9e2c5f8a1d4). At minimum build: administrative/case information with an explicit authority and scope statement (company-owned device, AUP, monitoring banner; in scope: file-access, removable-media, and cloud/webmail-upload artifacts and the timeline on the provided image; out of scope: Okafor's personal devices and any account not on the image); an executive summary written last; an evidence inventory distinguishing the container hash from the re-verified acquisition (bitstream) hash (Chapter 5); a versioned tools-and-methodology section; findings organized by investigative question, each built as the four-part finding, including your negative findings (anti-forensic tools? timestomping via $FILE_NAME` vs. `$STANDARD_INFORMATION per Chapter 21? anything that contradicts exfiltration?); supported, proportionate conclusions (write "consistent with copying of the dataset to a removable device on [date]," not "Okafor stole the data"); an honest limitations-and-assumptions section; and appendices (a mechanically generated exhibit hash list, the chain-of-custody record, a glossary, and a CV placeholder). Note which FRCP 26(a)(2)(B) elements you would add for the testifying-expert version. Use the templates in Appendix F. Save the draft and final to your case folder — this is the centerpiece your Chapter 38 capstone will assemble and the document you will defend in Chapter 27.

26.28 Finish the milestone with review. (a) Run the language-review pass over your own 26.27 draft and rewrite every flagged sentence. (b) If you can, hand the draft to a peer for technical and editorial review against the checklist; if you are solo, set it aside for a day and read it as the opposing expert trying to dismantle it. (c) Write a short review memo naming at least three specific things your review changed and why each change made the report harder to attack. Keep the memo — the gap between performing the steps and understanding them is exactly the distance between the draft and the memo.

Self-check. You have mastered this chapter when you can, without notes: build a report from its standard anatomy and justify the inverted-pyramid ordering; render one finding at three layers and say which Federal Rule of Evidence each layer serves; place any statement on the interpretive ladder and refuse to confuse a user account with a human operator; write a negative finding as a finding and explain why its absence is evidence; assemble a single four-part finding tied to a reproducible coordinate and verify that the hash citing it agrees everywhere; and write "the evidence is insufficient to reach a conclusion" without flinching when that is the truth. If you can hand a stranger your report and they can reproduce your method and reach your result — and an adversary reading it with a red pen finds the lines you already drew yourself — you are ready for Chapter 27 — Expert Testimony, where you climb into the witness chair and defend, under oath, every word you just learned to write.