COS/PSA 413 Day 22. Agenda WAGM will air a short segment on the CIAG lab on Thursday (Dec 1) during the 6PM broadcast Lab 11 Graded –3 A’s, 1 C and 1

COS/PSA 413

Day 22

Agenda

• WAGM will air a short segment on the CIAG lab on Thursday (Dec 1) during the 6PM broadcast

• Lab 11 Graded– 3 A’s, 1 C and 1 D

• Lab 12 (individual) due • Exam 3 Graded

– 5 A’s, 1 B, 2 B’s, 1 D and 1 F• Assignment 4 Posted

– Due December 6– Requires forensics analysis of evidence which you can perform during

Lab time tomorrow in OMS or N105– Must return the evidence disc

• Today we will be discussing Writing Investigation reports

Game Plan for last 4 weeks

• Nov 29– Investigation reports

• Nov 30– OMS or N105– Time to work on assignment 4

• Dec 2– Investigation reports Con’t– Using FTK to help build reports

• Dec 6– Becoming an Expert Witness– Assignment 4 Due

• Dec 7– Lab 13 OMS

• Dec 9– Becoming an expert witness Com’t

• Dec 13– Final Comprehensive Lab 14

• Dec 14– Lab 14 continued– Lab 13 due

• Dec 16– Assignment 5 Due– Exam 4

• Dec 22– 1-3 PM– Capstones due– Capstone presentations

Writing Investigation Reports

Chapter 13

Learning Objectives

• Understand the Importance of Reports• List Procedural and Evidence Requirements• List Types of Reports• Write Reports• Determine What’s Needed to Express an Opinion• Express an Opinion• Document a Report

Understand the Importance of Reports

References

• Two References– Federal Rules of Evidence

• http://www.law.cornell.edu/rules/fre/

– Federal Rules of Civil Procedures• http://www.law.cornell.edu/rules/frcp/

http://www.law.cornell.edu/rules/fre/

http://www.law.cornell.edu/rules/frcp/



Investigation Reports

For civil cases, The United States District Courts require that expertwitnesses submit written reports. State courts are also starting to requirereports from expert witnesses. Rule 26 of the Federal Rules of CivilProcedure requires that the written report include:

– All opinions– The basis for the opinions– The information that was considered in coming to the opinions– Related exhibits, such as photographs or diagrams– The curriculum vitae of the witness that lists all publications the

witness wrote during the preceding ten years– The fees paid for the expert’s services– A list of all other civil or criminal cases in which the expert has

testified, in trial and deposition as an expert, for the preceding four years


Lay Witness – A witness not considered an expert in a particular field. Generally will not have to file or submit a report

Limiting the Report to Specifics –

• You can now submit computing forensics reports electronically in many courts in PDF format. Do not file a report directly with the court unless you have been so directed by an attorney or the court.

• All reports should first repeat to the client the mission or goal of the investigation, as defined by the client. You can then contribute your definition of what you are seeking. Clearly defining the goals reduces the amount of time and cost of the examination.


Examination Plan – The plan laying out the strategy created by the attorney to try a case.

Verbal Informal Report – A report that is less structured than a formal report and is delivered in person, usually in an attorney’s office.

Verbal Formal Report – A structured report delivered in person to a board of directors or managers or to a jury.



A verbal informal report, for areas of an investigation that are yet to be completed:

- Tests may not have been concluded - Interrogatories - Document production - Deposition


Written Formal Report – A written report sworn under oath, such as an affidavit or declaration.

Written Informal Report – A report that is less structured than a formal report and is delivered in person, usually in an attorney’s office.

High-Risk Documents – A document that contains sensitive information that could create an advantage for the opposing attorney. Any written Informal report van be high-risk


Discovery – The efforts to obtain information before a trial by demanding documents, depositions, questions and answers written under oath, written requests for admissions of fact, and examination of the scene, for example.

Spoliation – Destroying or concealing evidence.

Expressing an Opinion

• Although it is not used as much today, the long preferred method for expressing an opinion has been to frame a hypothetical question based on factual evidence that is available.

• Example:– Attorney: Mr. Expert, In your opinion, if you where

asked to forensically examine a floppy disk and in the course of the forensics examination you discovered legible data in the unallocated portions of the disc, would you find this suspicious?


As an expert witness, you may testify to an opinion, or conclusion, if four basic conditions are met:

1. The opinion, inferences, or conclusions, depend on special knowledge, skill, or training not within the ordinary experience of lay jurors. 2. The witness must be shown to be qualified as a true expert in the particular field of expertise.


Continued...

3. The witness must testify to a reasonable degree of certainty regarding his or her opinion, inference, or conclusion.

4. Expert witness’s must first describe the data on what the opinion, inference, or conclusion, is based or, in the alternative, he or she must testify in response to a hypothetical question that sets forth the underlying evidence.


Keep the following guidelines in mind as you write your report:

- Don’t make any assumptions. - Don’t identify leads. - Check your spelling before the report leaves your office; don’t wait for a supervisor or the attorney to proofread your report. - Double-check the media that you have stored findings to. If you create a findings CD, make sure the data is on it before you send it out.


Think about the criteria for assessment of English language skills in a written report. You should criticize and assess the quality of your writing. Consider the following criteria:

- Communicative quality – Is it easy to read? - Ideas and organization – Is the information appropriate and clearly organized?


Think about the criteria for assessment of English language skills in a written report. You should criticize and assess the quality of your writing. Consider the following criteria:

- Grammar and vocabulary – Is there a good range of language used so that the meaning is clear and the text is not repetitive? - Surface features – Is the punctuation and spelling accurate?


Writing Investigation Reports

Provide lists or figures from the sources, as in the following examples:

• Personal (unpublished) communications• Lecture notes• Web sites• Single author journal paper• Multiple author journal paper• Book• Government/technical report• Chapter in an edited volume

Chapter Summary

- Deposition banks or libraries are used by lawyers to see examples of an expert witnesses’ previous testimony.

- Reports are critical to your investigations because they communicate your computer forensics findings and other information to the necessary authorities.

- Reports can be formal or informal, verbal or written. Consult with an attorney before creating a report because anything created can be requested for observation.

Chapter Summary

- You must help the reader by giving signposts.

- Clarity of writing is critical to the success of a report.

- Reports need to be grammatically sound, use correct spelling, and be free of writing errors. Avoid jargon, slang, or colloquial terms.

- Project objectivity; be detached in your observations for your report.

- For your report, stand back from the details and synthesize what has (and has not) been learned about the problem, and what it all means.