Finish the work

Chapter 18 / 18

Write what you know

The reader looks for the answer first. Show its evidence and limits too.

Short answer, clear evidence

The Liman report may start: ‘Today’s notice says closed for Sunday.’ Add the source and date. State ‘I did not check the door in person’. Confidence is about evidence strength. Impact is about how much a wrong outcome may matter. Keep them separate.

Read the question word

For FIRST or NEXT, check what is already done. BEST asks what fits this case best. MOST likely is not certainty. LEAST asks for the weakest fit. NOT and EXCEPT ask what does not fit. These words guide reading; they are not memorised answer rules.

Figure 18 · MindmapStudy sketch

Final page check

Final page check. Answer. Source and time. Other explanation. Missing data. Next stepEnlarge
These five parts help the reader check your report.CSINT Research · Ahmet Göker
Read as text
  • Answer
  • Source and time
  • Other explanation
  • Missing data
  • Next step

Same terms in both languages

Keep these words

BLUF
Bottom Line Up Front: give the main answer first.
Key judgment
The main supported conclusion.
Confidence / Impact
Strength of support / possible effect.
FIRST / NEXT
The first / next step needed now.
NOT / EXCEPT
Look for the item that does not fit.

A small example

Let’s do it together

Final task: write a three-line library report. Include one observation, one gap and one next check.

  1. Observation: ‘The dated notice says closed for 20 September.’ Add the source.

  2. Limit: ‘No in-person check was made.’ Do not hide a check that was not done.

  3. Next step: ‘Check the current official notice again before travelling.’

From my research notes · Real record

Beirut: write only what the map supports

Red draws the eye. It is easy to write a strong claim at once. First I read what the colour means.

ARIA / EOS · 2020

Likely damage around Beirut port shown as coloured cells
The colours come from radar analysis. They are not natural photo colours. The source says each coloured cell covers 30 × 30 metres.NASA/JPL-Caltech/Earth Observatory of Singapore/ESA; modified Copernicus Sentinel data (2020)NASA / JPL image use policy; Copernicus credit retained

Read the record

  1. Observation: the map has coloured cells around the port.
  2. Source explanation: the colours mark likely damage.
  3. Limit: one cell does not mean one building.
Decision flowStudy sketch

I wrote a conclusion

I wrote a conclusion. Does the record support it?. Yes: Add the source and limit. No: Narrow or remove the claimEnlarge
Read the question. Follow the matching branch.CSINT Research · Ahmet Göker
Read as text
  • Does the record support it?
  • Yes: Add the source and limit
  • No: Narrow or remove the claim

What I can write

The ARIA/EOS map points to areas of likely damage around the port for closer study.

Where I stop

This map does not give a count of destroyed buildings or say who was responsible. Anger cannot fill that gap. I need separate evidence.

NASA Earth Observatory · Scientists Map Beirut Blast DamageRead my full source comparison

These are existing public records. The images are resized for reading; no new image detail was generated.

Close the notes. Think first.

Your turn

The work is done. Should every piece of data go in the report?

Read the explanation

No. Keep what is needed to answer the question. Reduce personal data. Set who can read it and how long to keep it. Before an exam, also read the current rules in your own GIAC account.

Reading record

Only on this browser. These marks are not test results.

Sources

I used my study notes and wrote new practice examples. The source PDF is not distributed here.

About the sources and rights
© 2026 Ahmet Göker · CSINT Research. All rights reserved for the original text and drawings. Except where the law allows, ask for permission before copying or publishing them again. You can share a link to this book. Other names and sources belong to their owners.