AS-301i · Module 2

Forensic Report Writing

3 min read

A forensic report serves three audiences: the engineering team that will remediate, the legal team that will assess liability, and the executive team that will make business decisions. The report must be technically accurate for engineering, legally precise for counsel, and comprehensible for executives. This is not three reports — it is one report with three sections, each serving its audience without contradicting the others.

Do This

  • Structure the report as: executive summary, timeline, findings, evidence references, and recommended actions
  • State findings as facts supported by evidence citations — "the output contained customer PII (Evidence Artifact 7, line 143)"
  • Include limitations — what the investigation could not determine and why — to prevent the report from being treated as omniscient

Avoid This

  • Write the report in technical jargon only — the legal and executive audience will not understand and will not act on it
  • State conclusions without evidence references — unsupported conclusions are opinions, not forensic findings
  • Omit limitations — a report that claims to explain everything invites challenge on the parts it cannot prove