Chapter 5 — Engineering communication | Engineering Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Engineering communication

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Notes as evidence"]
  N2["5.2 Observation versus inference"]
  N3["5.3 Plain language"]
  N4["5.4 Structure"]
  N5["5.5 Visuals"]
  N6["5.6 Avoiding overstatement"]
  N7["5.7 Peer review of writing"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Notes as evidence"]
  N2["5.2 Observation versus inference"]
  N3["5.3 Plain language"]
  N4["5.4 Structure"]
  N5["5.5 Visuals"]
  N6["5.6 Avoiding overstatement"]
  N7["5.7 Peer review of writing"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Notes as evidence]
    |
    v
[5.2 Observation versus inference]
    |
    v
[5.3 Plain language]
    |
    v
[5.4 Structure]
    |
    v
[5.5 Visuals]
    |
    v
[5.6 Avoiding overstatement]
    |
    v
[5.7 Peer review of writing]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) write clear technical notes; (2) distinguish observation from inference; (3) write for non-technical readers such as lawyers; (4) structure a short report.

5.1 Notes as evidence

Examiners' contemporaneous notes may be disclosed in legal proceedings. SWGDE publications and NIST SP 800-86 both stress documenting what was done, when and by whom. Priya learns to date every entry and to record actions as they happen, not from memory later.

Contemporaneous means written at the time of the action, not reconstructed at the end of the day. Priya's notes include the exhibit number, what she did, the tool and version, and anything unexpected, such as a write blocker LED that did not light. Corrections are struck through and initialled rather than erased, so the note shows both the mistake and the fix.

5.2 Observation versus inference

"File invoice.zip was created at 19:05:40 UTC per the file system" is an observation. "The user downloaded malware" is an inference requiring more support. Reports mark the difference.

Between those two statements lie several steps: the file was created on this volume, the browser history shows a download with the same name at a nearby time, and the user account was logged in. Each step adds support, and each can be challenged. Priya writes reports so that every inference lists the observations it rests on and names at least one alternative explanation that was considered.

5.3 Plain language

A judge or jury may not know what a hash is. Priya practises: "A hash is a fingerprint calculated from the data; if even one bit changes, the fingerprint changes."

She tests her explanations on a non-technical friend and revises anything that needed a follow-up question. Analogies are chosen with care: a fingerprint captures the uniqueness of a hash but suggests biology, so she adds that the fingerprint is calculated, not found. When an analogy breaks down, she says where, so a cross-examiner cannot push it further than it goes.

5.4 Structure

Purpose; items examined; methods and tools with versions; findings; limitations; conclusion. Each finding points to the note or exhibit that supports it.

The limitations part is where the report states what was not examined, which tools could not parse a particular artefact, and which questions remain open. Putting it before the conclusion stops the conclusion reaching further than the work supports. Tool versions matter because parsers change: a finding produced by an older release may not reproduce with a newer one, and the reader needs to know which was used.

5.5 Visuals

Timelines and tables help, but every visual needs a caption naming its source data.

A timeline caption might read: 'Events from the NTFS file system and the browser history of exhibit NRF-12, times in UTC, generated with tool X version Y.' Colour should not be the only way to tell categories apart, because printed copies are often black and white. Every point on the chart must be traceable to a row in an appendix table. Scales on time axes are stated explicitly, because compressed gaps can make unrelated events look simultaneous.

5.6 Avoiding overstatement

Words such as "proves" or "definitely" are replaced with what the evidence shows and the conditions attached.

'The file was opened by the user' becomes 'the recent-documents entry is consistent with the file being opened from this account; it could also arise from synchronisation, which tests showed to be less likely.' The rewrite is longer, but each part can be defended. Hugo's rule is that if a word would make the examiner uncomfortable under cross-examination, it does not belong in the report.

5.7 Peer review of writing

A colleague reads the report cold and marks any sentence they could not defend if asked in court.

The reviewer receives the report without the case notes, which simulates a court reading it cold. Marked sentences go back to the author, who either adds the missing support or softens the claim. The review record stays in the case file. A report that comes back with no marks is treated with mild suspicion, and the reviewer is asked to try again.

Email and handover notes

Messages to colleagues about a case can also be disclosed. Priya writes them as she writes notes: factual, dated, with item numbers, and without speculation about people. When a task changes hands, a short handover note lists what was done, what remains and where the records are stored.

Worked example

Draft: "The suspect deleted the evidence to hide it." Rewrite: "invoice.zip was deleted at 19:20:00 UTC from the Downloads folder of user account 'mrios'. The examination does not show who was operating the account or why."

Synthetic case. The account and file are invented.

Errors and limits

Plain language must not become imprecise; simplify words, not facts.

Exercises

EX013 — Classify statements. Label "zip created 19:05:40 UTC" and "user downloaded malware" as observation or inference. Rubric: 3 = observation; inference with reason; 2 = labels only; 1 = reversed; 0 = none.
EX014 — Hash in plain words. Explain a hash for a jury in one sentence. Rubric: 3 = fingerprint, changes with any bit; 2 = partial; 1 = jargon; 0 = none.
EX015 — Deletion rewrite. Why is the rewritten deletion sentence better? Rubric: 3 = facts with time/account, no intent or identity claim; 2 = partial; 1 = shorter; 0 = none.

Synthesis

Clear, dated notes and reports that separate observation from inference are part of the evidence.

Continue studying — chapter 05 of 50

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →