Report Writing Flashcards

When documenting hash values in a forensic report, which algorithm is currently considered the minimum standard for evidentiary integrity verification?

Answer: SHA-256 or stronger

SHA-256 or stronger is the current minimum standard because MD5 and SHA-1 are vulnerable to collision attacks that could undermine evidentiary integrity.

In an EnCase forensic report, what is the primary purpose of including a 'Limitations' section?

Answer: To document scope restrictions, tool constraints, and conditions that may affect findings

A Limitations section transparently discloses scope restrictions, tool constraints, and environmental conditions that could affect the completeness or interpretation of findings.

Which EnCase feature generates an itemized list of all files examined, including deleted files, that should be referenced in the formal report?

Answer: File list report

The File List report in EnCase provides an itemized inventory of all files including deleted and unallocated entries that were part of the examination scope.

A forensic report states that a file was 'created' on a specific date. What caveat should accompany this finding?

Answer: Filesystem timestamps can be manipulated and may not reflect true creation time

Filesystem timestamps can be altered by anti-forensic tools, file copies, or timezone changes, so reports must note they may not reflect the true original creation event.

When referencing EnCase bookmarks in a formal report, the examiner should ensure that:

Answer: Each bookmark reference corresponds to a verifiable location within the acquired evidence file

Every bookmark referenced in the report must map to a verifiable, reproducible location within the forensic image so opposing counsel or another examiner can independently verify the finding.

What is the correct way to report findings from EnCase's keyword search results in a formal forensic report?

Answer: Report all keyword hits with context, location, and relevance determination

All keyword hits should be reported with their context, file location, and relevance determination to ensure completeness and avoid accusations of cherry-picking evidence.

In an EnCE-level forensic report, how should an examiner handle evidence that is exculpatory (favorable to the subject)?

Answer: Include all exculpatory findings with the same rigor as inculpatory findings

Professional forensic examiners must report all material findings including exculpatory evidence with equal rigor, as withholding such evidence is unethical and potentially unlawful.