±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 32607
New Yesterday: 2 Visitors: 75

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Examination Notes / Case Notes / Contemporaneous Notes

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3, 4  Next 

Examination Notes - Do you:

11
32%

11
32%

7
20%

1
2%

4
11%

 
Total Votes: 34

  

Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Sat May 27, 2017 1:40 pm

I’m wondering if anyone has or is working on creating standards in relation to taking forensic examination notes.

Thus far, I haven’t found a standard and it appears to vary a lot depending on the individual or agency. For example, some examiners:

- destroy all notes once a final report is created

- believe that their notes should be editable so they use Word or OneNote

- write everything in a paper notebook (write once – no delete)

- and others simply don’t document at all

Personally, I strongly believe in a write-once system that timestamps each note so that the date & time can be proven if required and that notes should be kept and provided to the courts for full disclosure.

I believe this to be especially true as warrants become more restrictive and concerns regarding privileged communication is increasingly argued by the defense in criminal cases.

But that is my view… I’m looking for feedback on what is currently the best-practice in regards to examination notes?

Assuming you should keep notes for court purposes, do you have concerns when the notes can be edited or changed?

Do you see current standards changing in the future as the courts begin to question our processes and the steps we take to get to the final outcome?

It is true that the “data is the data” in DFE, but if you look at DUI investigations, the trial is rarely about the overwhelming evidence. Instead it is about the steps an officer took to get the evidence with the officer often being questioned for extended periods on the stand about exactly what he did at the scene or in the lab. For DUI cases, this often leads to a non-conviction.

I think this is an important subject, so hopefully we can get a good discussion going. With replies, please include if you do civil or criminal work as I believe this does change perspective of this discussion.

Thank you.  

Merriora
Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Sat May 27, 2017 3:51 pm

I think "standards" are completely overkill for the concept of examination notes as they will inherently and inevitably restrict the necessary flexibility required in taking them. There are, of course, some universal elements that should be observed:

- contemporaneous - take notes as one works
- timestamped - mark the time, granularity is purely preference
- immutability of the final product - when complete the notes should be fixed.
- available - official/disclosable part of the case or incident file

Standardizing beyond these elements will quickly lead to ridiculous, unnecessary , and possibly irrelevant requirements.

Personally, write-once (regardless of implementation), is overkill. However, it is totally acceptable. I prefer one uses the editor/notebook of their choice and then print, lock, or translate their completed notes into an immutable or fixed medium or format for both archival and discovery purposes.

And yes, this is important and hopefully generates good discussion.
_________________
Preston Coleman, MFS, GCFE, EnCE

"The only thing necessary for the triumph of evil is for good men to do nothing" - Edmund Burke 

pcstopper18
Senior Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Sat May 27, 2017 8:45 pm

I really loved the 'forensic casenotes' application. BUt I dont think it is available anymore. Was a really nice program that.  

tootypeg
Senior Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Sat May 27, 2017 9:38 pm

One is often overlooked: Email. Easy to sign and encrypt, collaborative and manageable with existing procedures and software within the company.  

C.R.S.
Senior Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Sun May 28, 2017 10:07 am

I have just mentioned contemporaneous notes (CN) in a blog post. Have a watch of the videos about chip removal and consider how best you would produce simultaneous contemporary notes?

Forensic Chip Off - Notes in Progress - trewmte.blogspot.co.uk...gress.html  

trewmte
Senior Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Sun May 28, 2017 2:12 pm

Preston (PCStopper18)

Thank you for your detailed response.

Do you work civil or criminal cases?

I have a couple follow-up questions below.

- pcstopper18
I think "standards" are completely overkill for the concept of examination notes as they will inherently and inevitably restrict the necessary flexibility required in taking them. There are, of course, some universal elements that should be observed:

- contemporaneous - take notes as one works
- timestamped - mark the time, granularity is purely preference
- immutability of the final product - when complete the notes should be fixed.
- available - official/disclosable part of the case or incident file

Standardizing beyond these elements will quickly lead to ridiculous, unnecessary , and possibly irrelevant requirements.

So if "standards" were limited to your above points, would you feel this is an acceptable standard for the industry?

- pcstopper18

- timestamped - mark the time, granularity is purely preference

Do you feel that timestamping should be done via Digital Signature (and embedded timestamp) or manually written by the examiner?

If manual, do you see circumstances when an 'official' non-reputable timestamp would be preferred for some notes given limited search warrant parameters or key steps during the examination such as discussions with the lead investigator?

- pcstopper18

- immutability of the final product - when complete the notes should be fixed.

Do you feel like there should be a timeline on when a note should be fixed (non-editable)?

As an example, due to backlogs, some examinations will take months to complete as the files are put 'on hold' to concentrate on more urgent higher priority files by the requesting section.

- pcstopper18

Personally, write-once (regardless of implementation), is overkill. However, it is totally acceptable.

What specific issue do you see with write-once systems?

Write-once is a standard within many police departments for front-line officers as it is expected that they use a paper notebook and submit all notes. Although I agree that this is not preferred from our perspective as examiners, do you think this could cause future concerns if the steps and processes we take are questioned more in court?  

Merriora
Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Sun May 28, 2017 6:03 pm

trewmte:
My 2 cents...I will note that there is a clear distinction in the dictionary between contemporaneous (CN) and simultaneous (SN). They are not the same and I assert CN notes are the way to go specifically. For clarity, this means that notes are taken as soon as feasible after, or in conjunction with, the event/task being noted. It is not always feasible, or even possible, for SN notes. Now, if one were to truly challenge the notion, the answer would be yes because however impractical, unreasonable, or unnecessary, one could video the work being done. The video of the chip-off for example could be used as notes legitimately. However, the video method is fraught with concerns and isn't very popular for note taking in many fields.

Merriora:
I have worked in civil in the past, but currently work in criminal and have worked longer in criminal (U.S.A.).

If the "standards" were limited to either my points above, or very few finite points as determined by the consensus, that would be acceptable. An ISO document, as an example, for taking notes is overkill, unnecessary, and would lead to an unrealistic checklist for everyone that could not possibly be universal in real world application.

Timestamps can be embedded or manual. User preference. Both are acceptable. If you want to use a timestamp independent of instrumentation that you control (such as sending an email) to limit challenges then by all means. I'm for it and do do that in terms of communications. However, in legal proceedings it will still come down to someone's word or the trust of a note tool (if embedded) and if you didn't write it down in any fashion, then it didn't happen.

"Do you feel like there should be a timeline on when a note should be fixed (non-editable)?"


When the notes are complete, they should then be fixed in some fashion. If you are working in a productivity-driven team or an accredited lab/agency (as I do and have for most of my career) you don't get to put something "on hold." Metrics prevent that. They may be given a few days at best, but the exam is closed and the requestor is told to resubmit pending new information from them or given an explanation as to why the exam could not be completed at this present time and given options on moving forward to include closing the exam until they get us what we need to continue. Only in ad hoc shops do you have the "pick it up, put down" aspect. (Not saying its good, bad, or indifferent, just noting the difference.) I would say as long as you are recording the time then it shouldn't matter if you have gaps as long as they can be explained. In my need for thoroughness I would document such "breaks" in exam time if they were to occur.

Write-once systems prevent any sort of cleanup or fluid organization because if you make a mistake, typo, or something of the sort you can't do anything. You then have to make an additional note entry for every correction/addendum/observation that occurs. And if you copy and paste things into it you essentially defeat the purpose of writing it once. I don't see these as issues per se, just unnecessary facets of the chosen method.

For those front line officers taking paper notes, they can make changes. Usually, they must be crossed out and the change initialed. This is a typical process that I am aware of and may not be the norm everywhere. Also, they are not always mandated to submit them, just to keep them. This is a subtle but distinct difference. As far as court is concerned, scrutiny of one's notes should be expected. They should be written in anticipation of that eventuality. I dare say even welcomed, because it means they actually read them. I would also submit that if you are properly taking notes then they should withstand any scrutiny that implies wrongdoing or ineptitude. Then, scrutiny of one's method or process as documented in those notes should be expected and you should know why you do what you do and that what you do is sound or was as sound as could be done. In that instance, your notes are your cover, your substantiation, your defense as a technical practitioner, and not to be feared.
_________________
Preston Coleman, MFS, GCFE, EnCE

"The only thing necessary for the triumph of evil is for good men to do nothing" - Edmund Burke 

pcstopper18
Senior Member
 
 

Reply to topicReply to topic

Share and Like this forum topic to get more replies




Page 1 of 4
Go to page 1, 2, 3, 4  Next