[sleuthkit-users] Presentation of Evidence

[Regis C. <reg...@sb...>]

For my thesis I will be researching how digital analysis is properly 
logged and how the evidence is presented in court. I wish to add 
extensions to Brain's Autopsy Forensic Browser so that reports are 
automatically generated. I want these reports to provide a summary (or a 
timeline so to speak) of when the investigator performed what. I also 
want the reports to provide summaries of the actual evidence discovered 
during the investigation.  For example, the reports should contain 
information as to what deleted files have been recovered  and provide 
detailed information about the nature of that evidence. My question is, 
what is that detailed information? I have no experience on the legal 
side of digital forensics so I am hoping all you expert witnesses out 
there may be able to help me out. How should digital evidence be 
represented in court by means of a paper report? What is being done now 
and how do you think it can be done more effectively?

In theory, say you are using your digital forensics application. You 
complete your analysis and have now effectively completed you 
investigation. But now you need a way to show and explain everything you 
did and everything you discovered. You push the "generate report" button 
and the printer spits out a thick manuscript that details the whole 
entire investigation and you are done and ready to head to court. For 
the manuscript to be complete what all needs to be in it? Please respond 
with you suggestions and sources of where I may obtain more information.

Thanks in advance,
Regis Cassidy