Reporting

Reporting is the process of preparing a detailed summary of all the steps taken and conclusions reached as part of the examination. Reporting should include details about all the important actions performed by the examiner, results of the acquisition, and any inferences drawn from the results. Most of the forensic tools come with built-in reporting features which will autogenerate the reports while providing scope for customization at the same time. In general, the report may contain the following details:

• Details of the reporting agency
• Case identifier
• Forensic investigator
• Identity of the submitter
• Date of evidence receipt
• Details of the device seized for examination including serial number, make, and model
• Details of the equipment and tools used in the examination
• Description of steps taken during examination
• Chain of custody documentation
• Details of findings or issues identified
• Evidence recovered during the examination, ranging from chat messages, browser history, and call logs to deleted messages, and so on
• Any images captured during the examination
• Examination and analysis information
• Report conclusion