Chapter 26 — Further Reading

Foundations (🔬 deeper)

• NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response. Free from NIST. The standards-level statement of the examination-to-reporting arc; read its reporting guidance for the components this chapter's anatomy is built on.
• ISO/IEC 27042, Guidelines for the analysis and interpretation of digital evidence (and its sibling 27037 on acquisition). The international standard your method and report should match, so that opposing counsel argues against the standard, not just against you.
• Eoghan Casey, Digital Evidence and Computer Crime (Academic Press). Authoritative on the integrity, interpretation, and reporting principles that make findings admissible — especially the discipline of separating observation from inference.

Approachable explanations (everyone)

• William Zinsser, On Writing Well and Strunk & White, The Elements of Style. Not forensics books — writing books. The plain-language, clutter-free prose this chapter demands of you is a craft, and these are the two shortest paths to it. Read them for the lay-reader layer.
• Bill Nelson, Amelia Phillips & Christopher Steuart, Guide to Computer Forensics and Investigations (Cengage). A classroom-friendly walk through report structure with sample reports — a gentle on-ramp if the standards documents feel dry.
• SANS DFIR "Reporting" resources and posters. Practitioner templates and worked examples; search for "forensic report template," "report writing DFIR," and "executive summary forensics."

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 🔍📜 SWGDE Best Practices for the Examination/Reporting of Digital Evidence. The published reporting guidance from the Scientific Working Group on Digital Evidence — the field's consensus on what belongs in a report.
• 📜 Federal Rule of Civil Procedure 26(a)(2)(B); Federal Rules of Evidence 702, 703, 705, 1006. Read the actual rule text once. FRCP 26 is the contents of a testifying-expert report; the FRE provisions are the structure of the three-layer report made law.
• 📜 Reference Manual on Scientific Evidence (Federal Judicial Center), 3rd ed. Free PDF. How judges evaluate expert reports and methods under Daubert — invaluable for writing conclusions that survive a reliability challenge.
• 🔍 NIST CFTT tool-test reports and the CFReDS / "Hacking Case" reference images (cftt.nist.gov; cfreds.nist.gov). The independent validation you cite for your tool-version block, and images you can validate against before a real case.
• 🛡️ A SANS or vendor IR report template. The faster internal cousin of the forensic report; study how it optimizes for timely decisions while still documenting evidence and method — and where it diverges (the Recovery vs. Forensics callout).

Reference (this book)

• Appendix F — Chain-of-Custody and Report Templates: fill-in-the-blank templates for every section in this chapter, plus the pre-release review checklist.
• Appendix E — Legal Frameworks Reference: FRCP 26, the FRE provisions, and Daubert/Frye tabulated.
• Appendix B — Python Forensics Toolkit: reusable versions of the language-review and mechanical hash-list helpers.
• Chapter 5 — The Forensic Process (the maxim if it isn't documented, it didn't happen) · Chapter 25 — The Legal Framework (authority, Daubert) · Chapter 28 — Ethics (impartiality, the duty to report exculpatory evidence).

Do, don't just read

• Write a real report. Take any prior lab or practice image and produce a full report from this chapter's anatomy — including an executive summary written last, four-part findings tied to coordinates, and an honest limitations section. (The progressive project in exercises.md is exactly this.)
• Run the red-pen pass. Read an old write-up of your own and highlight every "obviously," "clearly," "must have," and "the user did X." Rewrite each to state only what the evidence shows. You will be unsettled how often confident prose outruns its proof.
• Trade reviews with a peer. Hand someone your report and ask them to find the unsupported inference and the undefined term. Better a colleague finds them than opposing counsel does.

Next: Chapter 27 — Expert Testimony: the report goes on trial with you — qualification under Daubert and FRE 702, the voir dire challenge, direct and cross, and the drill on defending every word you wrote.