A *template* for success!
I exist in an interesting dual-state of being where I am simultaneously a solo examiner trying to keep up with work, and an instructor for other examiners starting down their own paths. When I initially got into my position, it didn’t come with many instructions. The previous examiner left around the same time that I arrived. I have been fortunate to receive education from a variety of sources along the way, to include some advice from local mentors at other agencies. At a certain point, however, I needed to step away from the classroom and put what I’ve learned into practice.
One of my biggest struggles has consistently been deciphering and managing expectations, both mine and the folks I’m doing this for. With no checklist to work through, I am often left to my own estimation regarding the necessary depth of my work. The problem then becomes…. all the shiny new artifacts, convoluted rabbit holes, and the caffeine that emboldens me to explore them. Keeping on task with realistic goals is important, and something that I consistently try to hold myself accountable to.
Now take this struggle with a singular complex case and add… more cases! Of course, not every case demands the same amount of attention. Some cases are attempting to answer a simple question, others will simply not contain the answers to the questions being asked at all. But the existence of those more complex, in-depth cases requires a consistent process.
One of the first digital forensic courses I was fortunate to take after my promotion was Basic Computer Evidence Recovery Techniques (BCERT) through the National Computer Forensics Institute. In addition to the technical education, one thing that has stuck with me since the days of yore (2018) was a template that I built in class. The premise was fairly straightforward: be consistent and you won’t forget things.
My agency didn’t have a template for digital evidence reports, so it was on me to make one. Did you see the title? A template for success??
It started out simple, and grew piece by piece each time I was unsatisfied with a report or I was asked a question by an investigator or a lawyer from either side of the table that hadn’t already been answered. Finding and then addressing the shortcomings of my template is something that I am still working on, it’s not done. My general makeup of the template goes like this:
- Header
- Case number(s)
- Start/end dates
- Legal authority/scope declaration
- Synopsis of case prior to exam
- Housekeeping Items
- Tools and versions of tools used for the report
- List of items addressed/examined as well as status (included or not, successful or not, etc.)
- List of supplementary encrypted reports and their generated passwords
- Item block (specific to one item, repeats as needed)
- Item identification/information/picture
- Initial observations/acquisition of data
- Acquisition hash(es)
- Post-examination hashes
- Examination details
- Findings
- Ties the individual items together
- Indicates questions that were or were not able to be answered for the investigators
- Details where and how the report(s) and original acquisitions are being stored
Each section has a reason, and I’m sure there are plenty out there who have a similar but distinct approach. I find that by keeping a template that is organized in the order that I typically process things, the writing process flows much smoother.
Regarding the encrypted reports mention earlier - I work with Internet Crimes Against Children (ICAC) cases from time to time. The majority of my reports are redacted and dont contain anything explicit, however in some cases I have to prepare reports with very sensitive content either for a defense interview or for a trial. In those cases, the reports that I generate are encrypted with complex, randomly generated passwords. These passwords need to be documented somewhere, so I keep them in the digital examination report. This report is saved into one location as far as our evidence is concerned, and the encrypted reports are saved to another secure location. I would not reccommend storing locked containers next to their keys. (I am presently working with public/private key encryption in a coding project and am considering moving to this solution instead.)
When discussing the acquisition/post-examination hashes, the whole idea is to show the integrity of the evidence. Now, this usually shows up in the form of a screenshot or pasted text into a document, which in itself doesn’t say much other than I’m claiming the hashes matched as I said they did. The great thing about hashes is they can be verified again in the future. The purpose here is simply to show that I hashed the items at least twice and I’m presenting each one side by side. I typically try to use different utilities between the beginning and the end values, it shows there was no brand-influenced self-confirmation hanky panky going on. It’s effectively a fancy checkbox saying that the evidence is the same now as it was at the beginning, while offering the comparison value for future examiners to check.
I like Eric Zimmerman’s Hasher.exe, personally. Beyond having respect for how creatively he names things (I can relate), the interface is simple, the price is right and the results are consistent. Check his tools out here:
Regarding the findings section, this is the slipperiest part of the slope in my eyes. The purpose of this report is to document the facts of the case, the artifacts observed and lay the groundwork for how those items were located and correlated to each other. I do not make it a practice to offer up opinions or conclusions as to what the facts mean, beyond what I can articulate based on solid foundations. My opinions don’t belong here, the purpose is just to offer up the data to let it stand on it’s own provenance.
What’s missing?
My template isn’t done. I think that a topical glossary, curated for each case would be great.
If the report is long enough to warrant it, a table of contents could be helpful to navigate the information.
Within the device identification block, I have considered placing explicit fields as opposed to my usual screengrab or copy/paste of information from a tool.
Ultimately, an interactive report would be great, where clicking elements navigates or accesses files. I’m not there yet.
If you’re curious about how others are structuring their reports, here are a few links I have found to show guidelines, templates, and actual workproduct:
Forensic Focus post about writing a report
‘brootware’ blog post about writing a report
Another Scribd report template
UK guidelines for digital forensic reports