Hello,
I have a quick questions about note taking. When you are performing investigations with software such as Encase, where data can be recorded as you go along, do you still create contemporaneous notes separately? Either by hand or with programs such as Forensic Case Notes?
I'm performing a mock investigation to prepare for an interview next week using prodiscover basic, and what to show them a report so they can see what I can do.
Thanks!
I hope that, as part of your interview preparation, you have acquainted yourself with the ACPO guidelines.
Principle 3 states - An audit trail or other record of all processes applied to a computer based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result.
We still handwrite notes. It is extremely unlikely that any computer examination will ONLY use EnCrash - when you start to use other tools how do you create a unified note of your actions if you are only relying on EnCrash?
We have trialled some digital note taking methods but we still come down on the side of handwritten notes - could be the Luddite tendencies displaying themselves I guess??
Good luck with your interview!!!
Nigel
Indeed, I have the ACPO guidelines on the wall in front of my pc!
It's with the police. Fortunately the chap next door was highly ranked in the plod, so I'm getting tips on health and safety and diversity related questions tomorrow.
Case Notes seems forensically sound so far. Each input is MD5 hashed.
Thanks for the reply.