Intro to Report Writing for Digital Forensics
So you've just completed your forensic examination and found that forensic gem or smoking gun in your case, so how do you proceed? Depending on where you fall as a forensicator (e.g., law enforcement, intelligence, criminal defense work, incident response, e-discovery) you will have to report your findings. Foremost, find out what type of work product you are going to be required to produce to the client, attorney, etc. This will be your guide for completing your report. While the report writing part of the digital forensic examination process is not as fun as the forensic analysis, it is a very important link in the chain...
Author's Note: I originally wrote this article for the SANS Digital Forensics and Incident Response Blog in August of 2010. It has generated a lot of questions, feedback, and references over the past few years so I wanted to add it to my blog as well.