Maintaining an accurate record of each and every action together with the reasons is an extremely important principle. As it's already been made clear, the aim is to provide a detailed list of steps, which others can work along with and reach exactly the same conclusion with the same evidence.
The previous page explained there are three principal sets of documents to any forensic process.
Investigators notes: This is a detailed record of all the actions undertaken by the investigator, together with reasons of why it was done. To maintain a chain of evidence, forensic investigators have to record in considerable detail all the identifying features of hardware and software used.
Fortunately, much of this recording work is automated by the digital forensic software. But the investigator still has to make notes of why actions were undertaken and their results. In many cases these notes are only attached to the case and would only be consulted if there was a dispute.
Investigators report: This is the main section of the report which is followed by the findings. The investigators notes may be provided separately or attached as an appendix. The note would only be referred to, if there was a dispute over the findings.
The report would begin with a description of the context of the case. Essentially, this is briefing from the commissioning agent: i.e. the police or agency who is asking for the investigation.
The briefing determines how the investigation proceeds as it sets out the suspected crime, what evidence should be looked at, what should be looked for and consequently guide how it should be looked for.
Investigators findings: These are the conclusions that can be drawn from the results of the analysis. The idea is that there is an unbroken chain from the initial briefing, to the analysis, to the findings that leaves no doubt as to what was done, how it was done, why it was done and who did it.(who, what, why and how)