Hey everyone welcome to the last section of this course reporting.
So far we've covered the evidence collection acquisition and analysis phases of digital forensics in
this section we're going to introduce reporting the last stage of the digital forensic process.
We're going to cover some of the reporting tools included in Cali Linux will show how to produce a report
when analyzing a forensic image with autopsy.
Let's move on to introducing report writing in digital forensics.
We're going to take a look at why reporting is important in digital forensics as well in every analytical
process.
And we're going to explain the steps that comprise the reporting phase and the structure of a well-written
and effective report.
Reporting is the last stage in the digital forensic process.
We could say the last but not the least because it plays an important role as the other phases of digital
forensics in this phase.
We have to produce a clear and effective report of all the findings discovered as well as the tools
and technique used during the analysis.
The report might then be submitted to a court or to a company's management depending on the case it
shall be written to be readable and understandable by non-technical people.
The process of report writing could be divided into four stages report planning information collection
first draft writing and reviewing and finalization first stage report planning.
We define the objectives the target audience and the contents of the report as well as the estimated
time we're going to dedicate to writing it in information collection.
We collect all the outcomes of bindings resulting from the previous analysis phase.
For us it's important to take notes and document the findings as well as the tools and the procedures
used.
It's advisable to always save the output of every tool used to a file in first draft writing.
We organize all the collected information in a structured way.
The final review phase is about checking the report to correct possible errors or inaccuracies and to
edit it professionally.
There are no established formats or standards for a digital forensic report but generally forensic examiners
follow with Scheme made by the following sections.
Case summary.
Forensic preservation and acquisition and forensic analysis section case summary typically includes
any relevant information regarding the case for example the reasons for the analysis how the case started
and so on preservation and acquisition.
The examiner must detail all the interactions with the digital evidence and the steps taken to preserve
and forensically acquired the evidence.
For example it's important to include the pictures of the scene and also the device is collected and
the hashes of the acquired images.
The forensic analysis section is usually the most detailed section of the report.
We typically include all the artifacts and evidence found during the analysis and the notes about the
tools and techniques that were used.
It's a good practice to include the output of the tools used and also some meaningful screenshots.
Final step is about writing the conclusions of the investigation then summarizing the discovered evidence
and reporting the facts in an impartial way.
But do so without giving any kind of interpretation or judgment which shall be formulated by someone
else.
Well done.
In this video we introduce the reporting phase and try to explain its importance in digital forensics
that we detailed the steps that form the reporting face and the structure of a well-written and effective
report.
The next video we're going to cover some of the documentation and reporting tools installed by default
on Kalli Linux and see how to produce a report.
After analyzing an image with autopsy.