Chapter 26 — Key Takeaways
The big idea
The report is the only part of your work anyone else will ever see — so the report is the work, as far as the world is concerned. The judge did not watch you image the drive; the jury never heard of the Master File Table; opposing counsel's expert reads your report hunting for the one sentence to turn into an hour of cross-examination. Your forty hours at the workstation exist, to everyone who matters, only as the document in their hands — the deliverable a decision-maker acts on, the permanent record, and the thing you will be cross-examined on years later when memory is gone and only the writing remains. A defensible report is defensive writing: every sentence anticipates "how could someone attack this?" and closes the gap before they reach it. What is written stands; what is not written did not happen and cannot be defended.
The anatomy, and why the order matters
A professional report follows a predictable skeleton (NIST SP 800-86, ISO/IEC 27042, SWGDE all converge on it; templates in Appendix F):
| Section | Its job | Serves |
|---|---|---|
| Administrative / case info | who, what, when, authority & scope | everyone |
| Executive summary | the bottom line, plain language, 1 page | decision-maker |
| Evidence inventory | every item: make/model/serial/hashes | verifier |
| Tools & methodology | tools + versions + validation; reproducible steps | opposing expert |
| Findings | by item or by question; each tied to its exhibit | all three |
| Conclusions | supported, proportionate, never speculative | decision-maker |
| Limitations & assumptions | what the evidence does not establish | all three |
| Appendices / exhibits | hashes, chain of custody, glossary, CV, raw output | verifier |
The ordering is an inverted pyramid: conclusions early where the decision-maker looks, dense proof late where the skeptic digs. Write the executive summary last and read it first.
Three readers, one document
- The attorney / decision-maker needs meaning — what it says for the case, in plain language, including bad news.
- The judge / jury / lay reader needs understanding — no jargon, or jargon defined; analogies that illuminate without distorting.
- The opposing expert needs to reproduce and attack — exact versions, offsets, hashes, methods.
- Serve all three by layering: plain at the front, precise at the back. The structure tracks the Federal Rules of Evidence — FRE 702 (help the trier understand), 703/705 (bases of opinion), 1006 (summary of voluminous data).
The interpretive ladder, and what not to write
- Keep fact → inference → opinion on distinct, labeled rungs; never let an inference pose as a fact or an opinion as a certainty.
- The account is not the person. Evidence ties activity to a user account, device, or session — not to a pair of hands. Say so in writing.
- A matching hash proves integrity, not authorship, origin, or intent. State each finding for exactly what it shows.
- Leave out speculation, legal verdicts (guilt/liability are the court's, not yours), and pejorative or intent-laden words. Describe; do not characterize.
- Put in negative findings — "I looked for malware and found none" is a finding. Absence is evidence; it proves thoroughness and discharges the duty to report exculpatory as well as inculpatory evidence.
- Build each finding in four parts: observation → supporting artifacts → interpretation → limitation. Pin tool versions, tie every claim to a reproducible coordinate, generate the exhibit hash list mechanically, and submit the report to technical and editorial review before release.
You can now…
- ☐ Build a complete report from its standard anatomy and choose between organizing findings by item or by investigative question.
- ☐ Write one document for three audiences by layering plain-language conclusions over reproducible technical detail.
- ☐ Keep facts, inferences, and opinions distinct, and refuse to confuse a user account with a human operator or your role with the court's.
- ☐ Document negative findings and limitations as deliberately as positive ones, and pin and validate tools so a stranger can replay your method.
- ☐ Write the gravest case clinically, and write "the evidence is insufficient to conclude" without flinching when that is the truth.
Looking ahead
Chapter 27 — Expert Testimony. The report you just learned to write now goes on trial with you. Next: qualification as an expert under Daubert and FRE 702, the voir dire challenge, direct and cross-examination, explaining the MFT to a jury, and a cross-examination drill on the very anchor-case report you assembled — because the report is only as strong as your ability to defend every word of it under oath.
One sentence to carry forward: Write every report for the adversary who will read it with a red pen, and the friendly reader can trust it absolutely — draw your own lines, and no one can cut you along them.