±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 32607
New Yesterday: 2 Visitors: 118

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Examination Notes / Case Notes / Contemporaneous Notes

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3, 4  Next 

Examination Notes - Do you:

11
32%

11
32%

7
20%

1
2%

4
11%

 
Total Votes: 34

  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Sun May 28, 2017 6:37 pm

Good feedback pcstopper. Your 2 cents worth is highly valid.

- pcstopper18
trewmte:
My 2 cents...I will note that there is a clear distinction in the dictionary between contemporaneous (CN) and simultaneous (SN). They are not the same and I assert CN notes are the way to go specifically. For clarity, this means that notes are taken as soon as feasible after, or in conjunction with, the event/task being noted. It is not always feasible, or even possible, for SN notes. Now, if one were to truly challenge the notion, the answer would be yes because however impractical, unreasonable, or unnecessary, one could video the work being done. The video of the chip-off for example could be used as notes legitimately. However, the video method is fraught with concerns and isn't very popular for note taking in many fields.


The point of raising simultaneous notes is not to contradict CN but to indicate, given the complexity of the work shown in the youtube videos, digital stills or, more relevant, videoing of work undertaken can be used as supporting traceability procedures that can be referred to in the CN. Law enforcement and private labs can and do use digital stills and videoing techniques, from time to time, for a variety of reasons and have done so for many years. However, simultaneous notes, still require examiner reference back-up statements in the CN as digital stills and videoing may not be able to confirm for instance e.g. the type of chip off adaptors being used (http://www.acelaboratory.com/pc3000flash.php). Moreover, videoing is useful where chip off has taken place but a Waiver notification (no fault) is used instead of a court order (which my contacts in the States tell me videos can be used to back up the Waiver to prove no damage or any reasons why damage was caused to a phone).
_________________
Institute for Digital Forensics (IDF) - www.linkedin.com/groups/2436720
Mobile Telephone Examination Board (MTEB) - www.linkedin.com/groups/141739
Universal Network Investigations - www.linkedin.com/groups/13536130
Mobile Telephone Evidence & Forensics trewmte.blogspot.com 

trewmte
Senior Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Sun May 28, 2017 7:56 pm

The point of raising simultaneous notes is not to contradict CN but to indicate, given the complexity of the work shown in the youtube videos, digital stills or, more relevant, videoing of work undertaken can be used as supporting traceability procedures that can be referred to in the CN. Law enforcement and private labs can and do use digital stills and videoing techniques, from time to time, for a variety of reasons and have done so for many years. However, simultaneous notes, still require examiner reference back-up statements in the CN as digital stills and videoing may not be able to confirm for instance e.g. the type of chip off adaptors being used (http://www.acelaboratory.com/pc3000flash.php). Moreover, videoing is useful where chip off has taken place but a Waiver notification (no fault) is used instead of a court order (which my contacts in the States tell me videos can be used to back up the Waiver to prove no damage or any reasons why damage was caused to a phone).
- trewmte

Agreed. The combination of CN & SN in the situation as you described is very useful and I would say very substantive.

This, in my opinion, would support my notion that an overly burdensome standard of note taking would make even the video scenario you described untenable as there is no limit to the restrictions some would place on it in the name of "traceability" for example.

Great points.
_________________
Preston Coleman, MFS, GCFE, EnCE

"The only thing necessary for the triumph of evil is for good men to do nothing" - Edmund Burke 

pcstopper18
Senior Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Mon May 29, 2017 3:29 am

Big fan of One Note. Namely because it allows me to just send things over the printer to the the document for things that needed to be hand written. When I'm on scene, everything is hand written. Times don't really matter -- your notes are there so a person of like experience could duplicate your methods and report if the findings were valid or not. Timestamps don't do anything unless you plan on billing your client later IMO.

For final reports, it is done in Word and printed out and then wet signature applied. It is then uploaded back to the computer and I put it in with my Case Notes to show that I had indeed completed the final paperwork for the case if the Requestor comes back and says I haven't completed it. PDF for the digital copy in the event it needs to be reprinted or distributed.

Where I work case notes are not turned over as they are a Work Product Privileged document unless there is a specific need from opposing counsel that states they are required in order to see if steps were taken that I have indeed stated in my final report were done. Even then, IF the judge approves (which they've only done so once) they are so heavily redacted they really only get mush to look at anyway.

But under no circumstance should anything be destroyed/deleted after the case is complete unless specifically requested by your counsel to do so. Seen quite a few folks in multiple countries get jammed up pretty bad because of this.  

Randy_Randerson
Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Mon May 29, 2017 9:20 am

- Merriora
I’m wondering if anyone has or is working on creating standards in relation to taking forensic examination notes.


IMHO, the standard should be, can you return to the examination 6 months or a year later, and reproduce the same results, given the same data? Or, can you complete the examination, and then hand your notes and the original data to another examiner, and have them produce the same results (note, I did not say "findings or interpretations based on the results...") without any additional input?

I tend to find that the pursuit of "standards" in this case is nothing more than an attempt to justify not keeping case notes at all.

For the record, I have done civil work, but never criminal. I've spent about 20 yrs as a consultant, and seen in that time that remarkably few examiners even bother to keep case notes, in any manner. I have hear some say that they keep case notes in written form, and knowing that they have a cell phone with a camera, have asked for a copy of the notes...only to never receive them.

In my experience, I have also seen where this distinction of civil vs criminal, or not at all, has been used in an exclusionary manner, such as, "...you don't do criminal work, you wouldn't understand." I've had law enforcement officers ask me a question about something, but not be able to provide example data, yet I've had other officers (law enforcement, as well as officers of the court) turn around and provide me example data. One sent me Registry hive files from a Windows 8 phone, another sent me NTUSER.DAT files from a case involving a new version of file sharing software.

- Merriora
Personally, I strongly believe in a write-once system that timestamps each note so that the date & time can be proven if required and that notes should be kept and provided to the courts for full disclosure.


"Proven" how? I'm sorry, but I simply do not see the reasoning here.

If you're looking for some sort of standard across the industry, to include the private sector, I'd submit that the first standard should be simply to keep them. Let's just start there.  

keydet89
Senior Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Mon May 29, 2017 9:20 am

- Merriora
I’m wondering if anyone has or is working on creating standards in relation to taking forensic examination notes.


IMHO, the standard should be, can you return to the examination 6 months or a year later, and reproduce the same results, given the same data? Or, can you complete the examination, and then hand your notes and the original data to another examiner, and have them produce the same results (note, I did not say "findings or interpretations based on the results...") without any additional input?

I tend to find that the pursuit of "standards" in this case is nothing more than an attempt to justify not keeping case notes at all.

For the record, I have done civil work, but never criminal. I've spent about 20 yrs as a consultant, and seen in that time that remarkably few examiners even bother to keep case notes, in any manner. I have hear some say that they keep case notes in written form, and knowing that they have a cell phone with a camera, have asked for a copy of the notes...only to never receive them.

In my experience, I have also seen where this distinction of civil vs criminal, or not at all, has been used in an exclusionary manner, such as, "...you don't do criminal work, you wouldn't understand." I've had law enforcement officers ask me a question about something, but not be able to provide example data, yet I've had other officers (law enforcement, as well as officers of the court) turn around and provide me example data. One sent me Registry hive files from a Windows 8 phone, another sent me NTUSER.DAT files from a case involving a new version of file sharing software.

- Merriora
Personally, I strongly believe in a write-once system that timestamps each note so that the date & time can be proven if required and that notes should be kept and provided to the courts for full disclosure.


"Proven" how? I'm sorry, but I simply do not see the reasoning here.

If you're looking for some sort of standard across the industry, to include the private sector, I'd submit that the first standard should be simply to keep them. Let's just start there.  

keydet89
Senior Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Mon May 29, 2017 11:22 am

- keydet89

"Proven" how? I'm sorry, but I simply do not see the reasoning here.


"Proven" would be the ability to prove that a note was actually created or written at or before a certain time. With Digital Signatures and timestamps, this is possible. This isn't to say that the information is accurate, but simply written at a certain time which can go towards the credibility of the DFE if questions exist around how the search was conducted. (limited warrants, privilege information)

The question of when a note was actually written has come up in court in regards to officer notes, so this is where I draw that connection. In private industry, this doesn't seem to be a concern??

- keydet89

If you're looking for some sort of standard across the industry, to include the private sector, I'd submit that the first standard should be simply to keep them. Let's just start there.


I agree that as a minimum, the standard should be to keep notes. And perhaps "standard" is too strong of a word when discussing this subject?

Perhaps "Best Practice"?

I think as new DFE's enter this industry, they are looking for Best Practice advice in regards to conducting forensic exams. Most labs have their own ways of doing things and most labs have months of backlog. Hopefully by having these discussions we can find ways of improving how we conduct examinations while still using Best Practice guidelines.  

Merriora
Member
 
 
  

Re: Examination Notes / Case Notes / Contemporaneous Notes

Post Posted: Mon Jun 19, 2017 7:26 pm

- tootypeg
I really loved the 'forensic casenotes' application. BUt I dont think it is available anymore. Was a really nice program that.


There is a new version out which writes to a database and now allows adding of checklists, has a spellchecker and template feature.

We use it at the moment.  

zhaan
Member
 
 

Reply to topicReply to topic

Share and Like this forum topic to get more replies




Page 2 of 4
Go to page Previous  1, 2, 3, 4  Next