A report that someone else can check
A forensic report is a written record of what you found, how you found it and what you could not find out. Its test is simple: another person with the same evidence should reach the same facts.
This lesson shows how to keep facts, evidence and opinion apart, so that the reader knows what to trust.
By the end of this lesson
Note
I can write a report that separates fact, evidence and opinion.
Key words
| Word | What it means | Example |
|---|---|---|
| Fact | a statement anyone can check in the evidence | |
| Opinion | a conclusion that goes beyond the evidence | |
| Reference | where in the evidence a fact can be found | auth.log, line 12 |
| Limitation | something you could not check | |
| Reproducible | another person can repeat your steps and get the same result | |
| Summary | a short paragraph at the top with the main findings |
The cells students fill in are left blank in this preview.
Facts can be checked, opinions cannot
A fact is something a reader can check in the evidence. An opinion is what you think the facts mean. Both belong in a report, but they must not look alike.
A good habit: write a fact in the plain present or past tense. Write an opinion with a word like probably, or I think.
Worked example: sorting statements
| Statement | Fact or opinion | Why |
|---|---|---|
| The file backup.zip has 48,211 bytes. | Fact | A reader can check the size |
| The login at 14:02 came from 203.0.113.50. | Fact | It is written in the log |
| The user probably copied the files to take them. | Opinion | No log says why |
| The person was a former employee. | Opinion | Nothing in the evidence says it |
The cells students fill in are left blank in this preview.
Every fact points to its evidence
A reader should be able to find any fact without asking you. So each one has a reference: the file, and the line or the hash.
Say how you found it too. Then the work is reproducible: another person runs the same command and gets the same line.
Find a fact and its line number
grep -n "^sshd" case/etc/passwdShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Count the facts in a small invented report
printf 'FACT one\nOPINION two\nFACT three\n' | grep -c '^FACT'Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The parts of a short report
| Part | What it holds |
|---|---|
| Summary | The main findings in a few sentences |
| Scope | What you examined, and what you did not |
| Method | The commands you ran, so others can repeat them |
| Findings | Each fact with its reference |
| Opinion and limits | What you think it means, and what you could not check |
The cells students fill in are left blank in this preview.
Say what you could not check
Every investigation has gaps. A log may be missing, a clock may be wrong, or a file may have been deleted. Write each gap as a limitation.
It is also honest to say how sure you are. Words like certain, likely and possible tell the reader how much weight to give a conclusion.
A common mistake
Warning
Many people think that if they find nothing, nothing happened. Not finding something only tells you it is not in the evidence you have. Write that no other login was found in this log, and not that no other login happened.