John, an incident response specialist, was hired to report on a data breach at 5andDime4U, an Internet product sales company. John wrote up the report, but failed to list the methodology he used to investigate the incident and did not provide a chain-of-custody report, as he assumed that his report was only for internal use. The company decided to pursue the hackers in court, but when they presented John's report it was denied.

a. Why was the evidence presented in John's report denied by the court?

b. What should John or any other forensic investigator always do when investigating and preparing a report, regardless of the assumed use of that report and evidence?