ZEKASTRA

SOP-09 · From notes to a report another examiner has checked

Reporting and peer review

Writing the report from the examination notes, separating observation from opinion, stating confidence and limits, and having a second examiner verify findings.

01Purpose and scope

To deliver findings that a reader without technical training can follow, that a technical reader can verify, and that a second examiner has independently checked.

All written outputs: technical reports, expert reports, preliminary findings, addenda.

02Prerequisites

  • Complete examination notes (SOP-08) and custody records (SOP-03).
  • The questions as registered at intake.
  • A second examiner not involved in the examination, with access to the working copy.

03Steps

  1. Answer the questions asked, in order

    Each registered question gets a numbered section with a direct answer, the evidence relied on, the method, and the limits. Questions that cannot be answered get a section saying so and why.

    RecordFindings sections.

  2. Separate observation, interpretation and opinion

    Observations are what the data shows, with reference. Interpretation explains what that normally means, with source. Opinion is the examiner's conclusion with its confidence level and the alternatives considered.

    RecordLabelled paragraphs.

  3. State confidence and limits explicitly

    Use a defined scale (for example: established, probable, possible, cannot be determined) and apply it consistently. List what was not examined, what was unavailable and what the evidence cannot show.

    RecordConfidence labels; limitations section.

  4. Include the verification material

    Item list with hashes, tools and versions, time-zone basis, acquisition and verification details, and an appendix that lets a technical reader locate each cited value.

    RecordAppendices.

  5. Peer review against the evidence

    The second examiner checks a defined sample of findings by locating the cited values in the working copy, re-performing key decodings, checking that confidence labels match the evidence and that limits are complete. Comments and responses are recorded.

    RecordReview record with sample, comments, resolution.

  6. Release and archive

    Final version hashed and dated; the notes, review record and report stored together with the custody records for the retention period required.

    RecordRelease record; archive index.

04Records produced

  • Report with findings, confidence labels, limitations and verification appendices
  • Peer review record
  • Release record with final hash

05Pitfalls

  • Writing 'the user did X' when the evidence shows 'account X was used to do X' overstates the finding.
  • A report without a limitations section invites the reader to assume completeness.
  • Peer review that reads the report without opening the evidence checks only the prose.
  • Tool output pasted without the tool, version and parameters cannot be reproduced.

06Forms

07Standards

  1. ISO/IEC 27042:2015 — Analysis and interpretation of digital evidence
  2. SWGDE — Requirements for report writing in digital and multimedia forensics
  3. ENFSI — Guideline for evaluative reporting in forensic science
  4. ISO/IEC 17025:2017 — General requirements for the competence of testing and calibration laboratories