What should be included in a computer forensic examination report?
As with the examination of any evidence, a well-documented chain of custody is a must. A forensic analysis should include notes taken by the examiner. These notes may not be included in a final written report, but they can and do get included in discovery requests. The report should detail the hardware examined, the procedures and software used in the examination and any evidence found. Often the volume of evidence is so large it will not be included in printed form, but will be included in electronic form (most often on CD or DVD).
