±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 33166
New Yesterday: 0 Visitors: 248

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Examination Notes / Case Notes / Contemporaneous Notes

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3, 4  Next 

Examination Notes - Do you:

11
32%

11
32%

7
20%

1
2%

4
11%

 
Total Votes: 34

  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Mon Jun 19, 2017 9:15 pm

Hmmm... there was a time when I recorded my activity with time stamp tones in the recorder...
I use a four color BIC pen and steno pad. Usually transcribe it by end of day into system.

I think as others wrote, the best practice is to produce notes which can be handed to someone and they could theoretically reproduce the activity, or reasonably evaluate the validity of the activities.

When I teach this, I always bring up other branch's of forensics (forensic pathologist for example). How many completely destroy the original in the examination process? What information handed to most of the opposing side's expert?
Examiner notes.  

jhup
Senior Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Sat Jun 24, 2017 7:56 am

In case you have used Case Notes previously, here is the newest version:

first-response.co.uk/casenotes/  

zhaan
Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Mon Jul 10, 2017 3:51 am

As a result of the discussions on this forum and with industry leaders, I wrote an article on The Importance of Documentation which is now available on Trewmte blog.

The purpose of the article isn’t to provide a singular and definitive answer to the question of what ‘examination notes’ should look like. Instead, the article is meant to further open up the discussions on what is acceptable in your area and see if we can work towards ‘best practices’ in the industry. This can help all of us as bad case-law in one region can quickly transform the legal landscape across your respective countries.

Please post your comments to the article in this thread including the aspects that you agree and disagree with.
- What legal concerns do you have in regards to your examination notes?
- What are your thoughts on a 'Best Practice'?  

Merriora
Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Mon Jul 10, 2017 12:51 pm

- Merriora

The purpose of the article isn’t to provide a singular and definitive answer to the question of what ‘examination notes’ should look like. Instead, the article is meant to further open up the discussions on what is acceptable in your area and see if we can work towards ‘best practices’ in the industry.


With all due respect, it seems like your article is essentially about how good your product is, and how better it is than any other method.

Mind you, I am not in any way saying that your product is not the third best thing in the world after ice cream and sliced bread, or that the other considerations on methods/procedures are not extremely valid, only that it can be easily (mis)taken as one of the various promotion/astroturfing pieces that are already all over the net.

Once said this - and again with all due respect - the idea of having *anything* of actual value accessible "from everywhere" (as is - at least partially and if I get it right - on the cloud) via Facebook, Google or similar is very different from what I would envision as "safe" or "protected".
Working on an air-gapped PC inside a faraday cage in an underground rebar concrete bunker with 5" thick steel doors is more like it Wink .


jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Mon Jul 10, 2017 1:29 pm

Just a couple of points to make about the article. I haven't used Forensic Notes and not connected with it. I was though happy to run the article as it highlights a wide disparity in techniques in use when it comes to features and securing content.

Why are so many products lacking securing data integrity?

Moreover, with ISO17025, the CPS guidelines, FSR guidelines and so on all indicating the importance to produce notes contemporaneous to the time of examination etc.; if these bodies and guidelines had intended notes could be altered surely they would say so?

Is there a suggestion Forensic Notes has gone over-board with features and securing data or is it the case the product reflects customer demand but which reflects that their customers have legal requirements if they use such a product?

I note John Douglas' Case Notes is not in the mix of the article. How does that solution compare to Forensic Notes?

Lastly, I think Rob has endevoured to report fairly on various techniques out there and in use so that is educationally helpful.

[Reason for correction: I was typing on my smartphone and my fingers are bigger than the phone's keys, so typos corrected.]
_________________
Institute for Digital Forensics (IDF) - www.linkedin.com/groups/2436720
Mobile Telephone Examination Board (MTEB) - www.linkedin.com/groups/141739
Universal Network Investigations - www.linkedin.com/groups/13536130
Mobile Telephone Evidence & Forensics trewmte.blogspot.com 


Last edited by trewmte on Mon Jul 10, 2017 3:14 pm; edited 1 time in total

trewmte
Senior Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Mon Jul 10, 2017 1:29 pm

Hey Jaclaz

I appreciate your reply. Honestly, I do not want to turn this thread into a discussion about my product, but about note taking in general and the solutions that exist which is the intention of the article. To keep this discussion going to see if "Best Practices" can be agreed on for those that are working in smaller forensic units and do not have SOPs in place. To hear reasons for and against different methods, including against solutions like mine.

There are pros and cons to every service which I attempt to point out. Mine may not be for everyone especially in an air-gapped bunker underground. ;-). For others, it may be a solution like OneNote, Word, CaseNotes or trusty paper notebook. As far as my product is concerned, I am simply hoping to create something of value to the forensic community.

This is meant to be an open discussion so that people that are looking for a solution can read the discussions and determine their best solution given their particular requirements.

From this thread and numerous discussions, I have learned a lot in regards to note taking which I was not aware of prior. Thank you to everyone that has shared their views. The difference in opinions and what should and should not be included in notes has been eye-opening, especially as we all deal with ever increasing workloads.

Cheers.  

Merriora
Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Wed Jul 12, 2017 5:16 pm

- jaclaz

Once said this - and again with all due respect - the idea of having *anything* of actual value accessible "from everywhere" (as is - at least partially and if I get it right - on the cloud) via Facebook, Google or similar is very different from what I would envision as "safe" or "protected".
Working on an air-gapped PC inside a faraday cage in an underground rebar concrete bunker with 5" thick steel doors is more like it Wink .


To make more clear the above note, there is most probably no issue whatever in the actual implementation of the crypto/protocols/whatever of the service/tool, but a Google or Facebook login (which are handy means to get access easily with a "same" ID/password to many services) should not be used for anything exception made for personal, not professional, stuff of the lowest importance.

Raise your hand (if you are either a Google or Facebook user) if you NEVER have used that id/login on a non-secure machine, or on another people PC/phone/device or when connected to an unsecure wi-fi network.

And those that raised your hand, please lower it IF you EVER used that login/password by mistake when attempting to access ANY other site.

Good, I see that no hands are in the air. Smile

Sure, if you have a "dedicated" Google or Facebook account that you ALWAYS and ONLY access from a (hopefully) secure connection you are good to go.

And - as a side note - the underground rebar concrete bunker is pleasantly fresh at around 22° in these days of exceptionally high temperature. Wink

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 

Page 3 of 4
Go to page Previous  1, 2, 3, 4  Next