Scope and questions asked, evidence received and how it was handled, tools and versions used, the acquisition and verification record, findings tied to specific artifacts, and an explicit statement of limitations. A report that states conclusions without the steps behind them cannot be reproduced, which is a methodology problem rather than a drafting one.
The sections that have to be there
Scope and questions. What was asked, by whom, and what was expressly excluded. A report whose scope is vague invites the argument that the examiner looked only where it suited.
Evidence received. Each item, with identifying detail — make, model, serial number, capacity — and how and when it was received. This is the written half of chain of custody.
Acquisition and verification. The method used, whether the source was write-protected, and the hash values computed at acquisition and confirmed before analysis. Its absence is the first thing an opposing expert looks for.
Tools and versions. Specific versions, not product names. Tool behaviour changes between releases, and a finding that depends on a particular parser is not reproducible without knowing which one ran.
Findings, each tied to its artifacts. Not a narrative. Each factual statement should be traceable to the specific record supporting it, so another examiner can go to the same place and see the same thing.
Limitations. What the analysis could not establish, what was not examined and why, and where the data is ambiguous. This is the section least often written and most often decisive.
Findings and opinions are different things
The distinction that separates a durable report from a vulnerable one:
A finding is what the artifacts record. A USB device with a particular serial number was connected at 18:42. Fourteen documents were opened in the following six minutes. A wiping utility was installed on the 3rd and executed on the 11th.
An opinion is the inference. That the pattern is consistent with bulk copying to removable media rather than ordinary use.
What lies beyond both is intent — that the person meant to steal the material — and an examiner who testifies to it has left their expertise. Artifacts do not record states of mind. Reports that blur these three levels are the ones that come apart under cross-examination, and they do so at the precise point where the witness cannot say which category a sentence belonged to.
What a well-written limitations section says
That deleted content on the solid-state drive may have been erased by the drive's own housekeeping before acquisition. That the phone's OS version permitted only a logical extraction, so deleted messages were not recoverable. That the cloud audit logs covered only the last 90 days, and the relevant period began earlier. That an alternative explanation for an artifact exists and could not be excluded.
Stating these plainly makes the rest of the report more credible, not less. An expert who has already named the weaknesses cannot be surprised with them, and a fact-finder tends to trust the witness who volunteered them.
The reproducibility test
Before signing, the useful question is whether a competent examiner given the same image and the same report could follow the steps and reach the same result. If not, the report describes conclusions rather than a method — and under the amended Rule 702 that is a gatekeeping problem, not merely a matter of weight.
From our work
Need this looked at properly?
Our examiners and testifying experts work these questions for a living. Tell us what you're facing.
Reviewed by Law & Forensics. See our editorial standards.