Chapter 14 Report Writing for High-Tech Investigations

1
Chapter 14Report Writing for High-TechInvestiga
tions
2

• Include in Written Report (as per FRCP)
• Expert opinions
• Basis for the opinions
• Information considered in coming to opinions
• Related exhibits
• Expert witness Curriculum Vitae

3

• Deposition Banks
• Store examples of an expert witness testimony
• Used by attorneys on either side to discover
  contrary positions that an expert witness may
  have made in the past

4

• Examination Plan
• Examination Plan lets an expert witness know
  what questions to expect during testimony
• Include
• Example questions that an attorney may ask
• Definitions of forensic terms and functions
• Substantive information the attorney may have
  omitted
• DONT Include
• Answers to questions
• Anything that could be construed as coaching by
  your attorney

5

• Avoiding Preliminary Reports
• Any written statement created during an
  examination is subject to Discovery
• Discovery allows one party to force the other
  parties to produce requested documents or other
  physical evidence
• Opposing council could demand copies of your
  preliminary reports as part of Discovery process
• Any discrepancies between the Preliminary Reports
  and the Final Copies could be used to discredit
  the expert witness

6

• Spoliation
• Spoliation is destroying or concealing evidence
• Destroying a draft or preliminary version of a
  report could be considered Spoliation and could
  subject the attorney or expert witness to
  evidentiary sanctions

7

• Structure of an Investigation Report
• Abstract
• Table of contents
• Body of report
• Conclusion
• References
• Glossary
• Acknowledgements
• Appendices

8

• Suggestions for Remaining Objective
• Avoid personal comments
• Base all opinions in reports on knowledge and
  expertise
• Dont use facts that can change, cannot be used,
  or are not relevant to your expert opinion

9

• Using FTK ProDiscover to Generate Reports
• Software tools can generate logs and other
  reports
• Output is text, MS-Word, or HTML format
• Reporting from forensics tools is intended to
  supplement, NOT replace a formal written report
• Forensic tool reporting is typically referenced
  in the Appendices of a formal written report