Documenting As You Go

Documentation is the difference between a smooth report-writing phase and a painful one. Every experienced pentester will tell you the same thing: if you document well during testing, the report almost writes itself. If you don’t, you spend twice as long trying to reconstruct what you did from memory and incomplete notes.

Good engagement documentation has four elements:

Timestamps. Every significant action logged with a timestamp. This matters for the testing timeline in the report and for any incident investigation if something goes wrong.

Commands and output. The exact command you ran and the relevant output. Not just “ran Nmap” — the full command with flags and the key findings from the output.

Screenshots. Annotated. Labeled. Every screenshot should have a caption explaining what it shows and why it matters. An unlabeled screenshot is useless two weeks later when you’re writing the report.

Context notes. Brief notes explaining why you did something and what you concluded. “Ran Kerberoasting because initial BloodHound showed 3 SPNs on service accounts” is infinitely more useful than just the Kerberoast output.

The evidence collection template you can download from this lesson gives you a structured format for all four elements. Use it from day one of any engagement.

On the right, you’ll see two versions of documentation for the same finding from the Navigating Security Corp engagement. Identify which is the professional version and what’s missing from the other.