Version
1.1.0
Published / updated
Reference status
Reference
Author / editor attribution
Jesse Shelley

Purpose and when to use it

Use reporting throughout the examination, then consolidate it for the intended audience. Distinguish a case conclusion from a laboratory artifact-behavior report and from a hypothetical teaching example.

Evidence required

Retain the source inventory, custody records, raw observations, validated derived views, tool versions, experiment notes, and reasoning. Identify redactions and unavailable evidence that affect reproducibility.

Principles and procedure

  • State the authorized question, collection scope, and report status.
  • Document evidence identifiers, handling, methods, versions, validation, and derivations.
  • Present observations with source references, then explain interpretation, alternatives, attribution, and confidence.
  • Include limitations, disclosed AI assistance, publication permissions, and a versioned correction history.

What to document

Use the Artifact Report schema for tested storage observations, not as a substitute for every case report. Ensure figures and tables identify their source and whether they are original, derived, or synthetic demonstrations.

Failure modes

A polished transcript can hide omitted branches. Unsupported statements may become harder to detect when mixed with raw findings, while sensitive identifiers can leak through screenshots or downloadable attachments.

Limits on the conclusion

A report cannot make missing evidence available or validate an untested method. Public redaction may limit replication; describe the constraint rather than claiming unrestricted reproducibility.

Independent checks and corroboration

Check citations, identifiers, numerical summaries, and quoted tool output against preserved sources. Ask whether an independent reader could distinguish the evidence from the author’s inference.

How to report the result

Keep a stable version and canonical location. Material changes to conclusions need an explicit correction or superseding version, not a silent edit.

Related methods

Related glossary terms

What does a reader need to check your conclusion?

Provide the question, evidence inventory, acquisition scope, versions, procedures, raw observations, derivations, and relevant validation. Connect each consequential claim to a source reference and explain negative findings, conflicts, and redactions.

Lead with the supported answer and its practical limit. Follow with the reasoning in an order that lets the reader inspect it, keeping teaching examples and hypotheses separate from actual findings.

Sources & further reading

Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.

  1. NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response

    IT-oriented forensic process and sources; published 2006. It is not a complete investigative procedure or legal advice.

    NIST · Primary · Last verified 2026-10-09

Canonical reference: https://syntheticforensics.org/methods/reporting/

Report a technical correction