Anyone have an "analyst worksheet" for cellular forensics they'd like to share? Basically for handwritten notes as an analyst is working on the evidence and steps taken.
Thanks!
Are you talking about how to take notes or notes like key artifacts and all?
Are you talking about how to take notes or notes like key artifacts and all?
Notes. Not how, but just a worksheet that someone already has completed that they may like to share. I have been working on a template in excel.
Case #, Case Name, contact info, make, model, damage, imei, s/n, battery installed?, SIM?, SD? passcode/pattern…
I don’t have a spreadsheet for you, but I did design an entire app around handling the type of notes you’re trying to take and maintain
Monolith Pro -
It sounds like you are on the right track. Depending on where you work, you should include the contact person for the case along with their contact information, the search warrant/court order number that authorized the analysis, and a space for the software and the version of the software you are using. For example, Cellebrite Physical Analyzer 7.xxxx and so on.
If there was a keyword list provided by the contact person or created by you or another examiner, I would have a space to document that, where it could be found, and if the search for those terms was completed. You will want a space to document if a report or other deliverable was created, to whom it was sent, and the way it was delivered (in person, shipped with tracking number, etc). If you have a property sheet that already documents such things, it will be up to you if you want this type of redundancy.
For those entries involving dates (for example when a keyword search was done, when the examination started, when the deliverable was sent out, evidence received/returned) leave a space so the date can be written out and not just a check box indicating it was done.
I do not have a copy of the form I created, but there were many times most of my case notes were on the sheet. It also shows a workflow documenting what has been done. In case, for some reason you are not available to complete the analysis (sickness, transfer, vacation, etc) or if someone needs an update on your analysis, all that needs to be done is someone to review your sheet and they can give the update or resume the analysis without duplicating steps.
Feel free to reach out to me if you want any further ideas or feedback on the spreadsheet you are working on.
Please send me a PM with your email address and I will send you our template Evidence Map Excel spreadsheet.
Our Evidence Map contains multiple tabs for recording all critical case information
Forensic Tracker tab Custodian information, device information, forensic preservation information, BitLocker and other passwords, uniquely assigned evidence numbers, evidence locker bin number location.
Timeline tab Significant events including who/what/when/source of evidence
Key Words tab key words and phrases
I am happy to share this tool with anyone else who sends me a PM. It is as valuable to our practice as any forensic software tool.
Basically when I need to write an affidavit or expert report, all information needed to include in such documents can be pulled from the matter specific Evidence Map.
** Quick Update I do not charge for the Evidence Map tracker as several people have asked me how much it costs. **
Hello! I am taking a MSc course in CyberSecurith and just starting a Digital Forensics subject. In order to have some guidance, could you share this worksheet with me? Really appreciated it!
Best regards
