Report Writing for High-Tech Investigations

Understanding the Importance of Reports

In some cases, a forensic report may be admissible in court, at an administrative proceeding, or as an affidavit to support the issuance of an arrest or search warrant.
A report can also be used to justify the collection of additional evidence and as evidence at a probable cause hearing, grand jury hearing, or motion hearing in civil or criminal cases.
Although there are no specific requirements for information in reports, you should retain a copy of any deposition notice or subpoena in order to include the following:
  * Jurisdiction
  * Style of the case
  * Cause number
  * Date and location of the deposition
  * Name of the deponent (the person testifying at deposition)
As an expert witness, you should be aware that lawyers use services called deposition banks.
* Deposition Banks: Store examples of expert witnesses’ previous testimony.
A lawyer sends copies of the opposing expert witnesses' depositions to the bank for storage following the conclusion of a case.
When the opposing party has designated an expert witness in preparation for a trial, the attorney may request copies of this witness's prior testimony.
Attorneys may also request transcripts of prior testimony from their own potential experts to ensure that they have not previously testified contrary to their current position.
Members of legal associations utilize electronic messaging lists to request copies of prior depositions given by a particular expert witness.

Limiting a Report to Specifics

The client (who may be an attorney, a detective, or an investigator) should establish the objective or mission of the investigation.
All reports to the client should begin with a statement of the mission or objective, which is typically to locate information on a specific topic, recover specific essential documents, or recover specific file types or files with specific dates.
Clearly defining the objectives reduces the time and cost of the investigation, which is crucial given the growing size of hard drives and the complexity of networks.
Identifying your audience and the purpose of the report prior to writing will help you focus on specifics.
Consider that if your audience has limited technical expertise, you may need to devote a portion of the report to educating them on technical issues.
You can accomplish this with a set of several stock paragraphs that you maintain, although you should periodically update these definitions.

Types of Reports

Examination Plan: A document that serves as a guideline for knowing what questions to expect when you’re testifying.
Verbal Report: A less structured than a written report. It takes place in an attorney’s office, where the attorney requests the consultant’s report.
A verbal report is typically a preliminary report that addresses unresolved aspects of the investigation, such as the following:
  * Examinations that have not yet been completed.
  * Interrogatories that the attorney may want to send to the opposing party.
  * Requests for or subpoenas for the production of documents.
  * Determining who should be deposed and developing a plan for their removal.
Written Report: Usually an affidavit or declaration. This type of report is sworn under oath, it demands attention to detail, carefully limiting what you write, and thorough documentation and support of what you write.

Guidelines for Writing Reports

An attorney formulates a hypothetical query based on the available factual evidence in order to express an opinion.
The law requires an expert who lacks personal knowledge of the system or occurrence to state opinions in response to hypothetical inquiries, which ask the expert witness to express an opinion based on hypothetical facts without reference to a specific system or occurrence.
Although the rules of evidence have relaxed the requirements for how an expert renders an opinion, structuring hypothetical questions for your own use ensures that your opinion is based on facts that are anticipated to be supported by evidence.
It is possible to abuse hypothetical questions by making them so complex that the expert cannot remember enough of the question to evaluate the answer.
A second misuse of hypothetical questions is that they effectively permit attorneys to recite their preferred facts to the jury repeatedly, in the order and with the desired emphasis.
As an expert witness, you can testify to an opinion or a conclusion if these basic conditions are met:
  * The opinion, inferences, or conclusions require specialized knowledge, skill, or training beyond the ordinary experience of casual witnesses and jurors.
  * It must be demonstrated that the witness is a qualified expert in the discipline.
  * Regarding his or her opinion, inference, or conclusion, the witness must testify with a reasonable degree of certainty (probability).
  * At a bare minimum, expert witnesses must be familiar with the pertinent data (facts) upon which their opinion, inference, or conclusion is founded, and they must be prepared to testify in response to a hypothetical question that lays out the evidence.

What to Include in Written Preliminary Reports

Discovery: The process of opposing attorneys seeking information from each other.
In a civil litigation matter, keep in mind that everything you record as part of your examination for a report is subject to discovery requests from the opposing counsel, meaning that anything you write may or will be provided to the opposing attorney.
Preliminary reports that are written down, such as those produced by software programs before all the data analysis is finished, are regarded as high-risk documents because the opposing counsel may seek discovery based on them.
Opposing counsel should anticipate using the written preliminary report to challenge your testimony if it takes a different or more ambiguous stance than you do in your final report or testimony.
If you do create a preliminary report, don't get rid of it before the case is finally settled or any discovery matter involving the report has been resolved.
The destruction of the report can be construed as the destruction or concealment of evidence; in the legal community, this is known as spoliation, and it could result in financial or evidentiary penalties for your client.
Include the same information in written preliminary reports as you would in an informal verbal report.
  * First, restate the assignment to affirm with the client that the completed work is appropriately focused.
  * Next, summarize the completed objectives. Describe the systems you've examined, the instruments you've utilized, and what you've observed.
  * Describe the methods of evidence preservation and protection you have employed.
The following list shows additional items to include in your report:
  * Summarize your billing history and provide an estimate for the remaining expenses.
  * Determine the provisional conclusion.
  * Identify areas for further investigation and validate the scope of your examination with the attorney.

Report Structure

A report usually includes the sections shown in the following list, although the order varies depending on organizational guidelines or case requirements:
  * Abstract
  * Table of Contents
  * Body of Report
  * Conclusion
  * Refereces
  * Glossary
  * Acknowledgements
  * Appendixes

Writing Reports Clearly

To produce clear, concise reports, you should assess the quality of your writing, using the following criteria:
  * Communicative quality: Is it easy to read? Think of your readers and how to make the report appealing to them.
  * Ideas and organization: Is the information relevant and clearly organized?
  * Grammar and vocabulary: Is the language simple and direct so that the meaning is clear and the text isn’t repetitive?
    * However, technical terms should be used consistently; you shouldn’t try to use variety for these terms. Using different words for the same thing might raise questions.
  * Punctuation and spelling: Are they accurate and consistent?

Designing the Layout and Presentation of Reports

Using appropriate section headings and titles is just one of many elements that go into layout and presentation.
There is a numbering scheme included in the layout.
* Report authors either utilize legal-sequential numbering or decimal numbering as their numbering scheme.
* Once you've decided on a system, be sure to stick with it throughout the report.
The material is divided into sections and the numbering is restarted with each main section in a report using the decimal numbering system.
* This technique makes it possible for readers to quickly scan the headings and determine how one section of the report links to the next.
The legal-sequential numbering system is often used in legal pleadings.
* Each Arabic numeral indicates a crucial piece of supplementary data, and each Roman numeral denotes a significant feature of the report.
* Because sequential numbering doesn't establish a hierarchy, this technique may not be as effective with nonlawyers.
Support the story using pictures, tables, statistics, and equations.
Consistency is more important than formatting text.
Describe how you studied the problem.

Report data collecting is crucial. Without good data in a lab notebook or file, completing a report is pointless.

Include Calculations
Providing for Uncertainty and Error Analysis
Explaining Results and Conclusions
Providing References
Include Appendixes