## 4 Experiment, Results and Discussion
### Forensics Analysis: Chrome Application as a Case
#### 4.2.4 Reporting  
The final stage of digital forensics involves preparing a court-acceptable report that presents the evidence collected by the digital forensic investigator. This report is crucial, as it can either substantiate or refute a case. Below, we examine the reports generated by the tools used in the experiment:  
* Belkasoft: Belkasoft generates reports by directly selecting artifacts from SQLite files, creating separate reports for each table in each SQLite file (Figure 20). The report comprises four sections: The first section includes the report's creation date and the name of the workstation user. The second section details the case, including its name, description, creation date, investigator's name, and time zone. The third section provides report customization options, such as artifact arrangement and grouping. The final section presents a table of artifacts. Importantly, a distinct report is created for each table in every SQLite file. * MAGNET AXIOM: The use of MAGNET AXIOM requires the inclusion of evidence screenshots from SQLite files in the report (Figure 21). It does not permit the direct selection of artifacts from SQLite files, but suggests capturing screenshots of evidence found in SQLite databases, as depicted. Each set of evidence referenced in the forensic report can be represented as a screenshot. * FINALMobileForensics: FINALMobileForensics captures evidence group screenshots and exports them as an Excel file. However, it notably lacks support for Arabic searches (Figure 22). In this tool, selecting evidence directly from SQLite files for report inclusion isn't feasible. Instead, each group of evidence mentioned in the forensic report can be captured as a screenshot, as seen in Figure 22. Evidence can also be exported to an Excel file, with each table's evidence in a separate Excel file. Notably, Arabic search terms may not display. * FORC Tool: The FORC tool adds selected evidence sets directly to the report, associating them with the case's name. This simplifies the creation of a unified report containing evidence from various tables and SQLite database files (Figure 23). In FORC, each SQLite file is opened, the table contents are reviewed, and evidence from each table is selected. The chosen evidence is then directly incorporated into the report and linked to the case's name. This approach enables the generation of a single report incorporating all the investigator-selected evidence from diverse tables and SQLite  
Figure 19: FPRC tool: Viewing the table contents. database files. The report is segmented into four sections: The first section contains case data (e.g., case name, description, date, and investigator's name), the second section encompasses workstation data (e.g., operating system, workstation name, and username), the third section includes phone data (e.g., device serial number, manufacturer, and device name), and the fourth section presents the pieces of evidence, complete with their paths, table names, and column names. Figure 21: MAGNET AXZIOM report. Figure 20: Belkasoft Report. Belkasoft, MAGNET AXZIOM, and FINALMobileForensic, while undoubtedly powerful, necessitate a high degree of investigator expertise and substantial manual labor for evidence extraction. These tools rely on manual methods, which, though time-consuming and labor-intensive, have been the norm in the field. However, this conventional approach has its limitations. It is prone to human error, often leading to files being overlooked or left unrecognized, particularly when file extensions are absent. Such shortcomings can have profound implications for investigations and potentially hinder the pursuit of justice. In response to these challenges, we introduced the FORC tool. This tool represents a paradigm shift in digital forensics, designed to address the shortcomings of manual extraction methods. The core innovation of FORC lies in its ability to autonomously identify and recognize SQLite files, irrespective of file extensions.