Join Us!

Examination Notes /...
 
Notifications
Clear all

Examination Notes / Case Notes / Contemporaneous Notes  

Page 1 / 2
  RSS
Merriora
(@merriora)
Junior Member

I’m wondering if anyone has or is working on creating standards in relation to taking forensic examination notes.

Thus far, I haven’t found a standard and it appears to vary a lot depending on the individual or agency. For example, some examiners

- destroy all notes once a final report is created

- believe that their notes should be editable so they use Word or OneNote

- write everything in a paper notebook (write once – no delete)

- and others simply don’t document at all

Personally, I strongly believe in a write-once system that timestamps each note so that the date & time can be proven if required and that notes should be kept and provided to the courts for full disclosure.

I believe this to be especially true as warrants become more restrictive and concerns regarding privileged communication is increasingly argued by the defense in criminal cases.

But that is my view… I’m looking for feedback on what is currently the best-practice in regards to examination notes?

Assuming you should keep notes for court purposes, do you have concerns when the notes can be edited or changed?

Do you see current standards changing in the future as the courts begin to question our processes and the steps we take to get to the final outcome?

It is true that the “data is the data” in DFE, but if you look at DUI investigations, the trial is rarely about the overwhelming evidence. Instead it is about the steps an officer took to get the evidence with the officer often being questioned for extended periods on the stand about exactly what he did at the scene or in the lab. For DUI cases, this often leads to a non-conviction.

I think this is an important subject, so hopefully we can get a good discussion going. With replies, please include if you do civil or criminal work as I believe this does change perspective of this discussion.

Thank you.

Quote
Posted : 27/05/2017 8:40 pm
pcstopper18
(@pcstopper18)
Member

I think "standards" are completely overkill for the concept of examination notes as they will inherently and inevitably restrict the necessary flexibility required in taking them. There are, of course, some universal elements that should be observed

- contemporaneous - take notes as one works
- timestamped - mark the time, granularity is purely preference
- immutability of the final product - when complete the notes should be fixed.
- available - official/disclosable part of the case or incident file

Standardizing beyond these elements will quickly lead to ridiculous, unnecessary , and possibly irrelevant requirements.

Personally, write-once (regardless of implementation), is overkill. However, it is totally acceptable. I prefer one uses the editor/notebook of their choice and then print, lock, or translate their completed notes into an immutable or fixed medium or format for both archival and discovery purposes.

And yes, this is important and hopefully generates good discussion.

ReplyQuote
Posted : 27/05/2017 10:51 pm
tootypeg
(@tootypeg)
Active Member

I really loved the 'forensic casenotes' application. BUt I dont think it is available anymore. Was a really nice program that.

ReplyQuote
Posted : 28/05/2017 3:45 am
C.R.S.
(@c-r-s)
Active Member

One is often overlooked Email. Easy to sign and encrypt, collaborative and manageable with existing procedures and software within the company.

ReplyQuote
Posted : 28/05/2017 4:38 am
trewmte
(@trewmte)
Community Legend

I have just mentioned contemporaneous notes (CN) in a blog post. Have a watch of the videos about chip removal and consider how best you would produce simultaneous contemporary notes?

Forensic Chip Off - Notes in Progress - http//trewmte.blogspot.co.uk/2017/05/forensic-chip-off-notes-in-progress.html

ReplyQuote
Posted : 28/05/2017 5:07 pm
Merriora
(@merriora)
Junior Member

Preston (PCStopper18)

Thank you for your detailed response.

Do you work civil or criminal cases?

I have a couple follow-up questions below.

I think "standards" are completely overkill for the concept of examination notes as they will inherently and inevitably restrict the necessary flexibility required in taking them. There are, of course, some universal elements that should be observed

- contemporaneous - take notes as one works
- timestamped - mark the time, granularity is purely preference
- immutability of the final product - when complete the notes should be fixed.
- available - official/disclosable part of the case or incident file

Standardizing beyond these elements will quickly lead to ridiculous, unnecessary , and possibly irrelevant requirements.

So if "standards" were limited to your above points, would you feel this is an acceptable standard for the industry?

- timestamped - mark the time, granularity is purely preference

Do you feel that timestamping should be done via Digital Signature (and embedded timestamp) or manually written by the examiner?

If manual, do you see circumstances when an 'official' non-reputable timestamp would be preferred for some notes given limited search warrant parameters or key steps during the examination such as discussions with the lead investigator?

- immutability of the final product - when complete the notes should be fixed.

Do you feel like there should be a timeline on when a note should be fixed (non-editable)?

As an example, due to backlogs, some examinations will take months to complete as the files are put 'on hold' to concentrate on more urgent higher priority files by the requesting section.

Personally, write-once (regardless of implementation), is overkill. However, it is totally acceptable.

What specific issue do you see with write-once systems?

Write-once is a standard within many police departments for front-line officers as it is expected that they use a paper notebook and submit all notes. Although I agree that this is not preferred from our perspective as examiners, do you think this could cause future concerns if the steps and processes we take are questioned more in court?

ReplyQuote
Posted : 28/05/2017 9:12 pm
pcstopper18
(@pcstopper18)
Member

trewmte
My 2 cents…I will note that there is a clear distinction in the dictionary between contemporaneous (CN) and simultaneous (SN). They are not the same and I assert CN notes are the way to go specifically. For clarity, this means that notes are taken as soon as feasible after, or in conjunction with, the event/task being noted. It is not always feasible, or even possible, for SN notes. Now, if one were to truly challenge the notion, the answer would be yes because however impractical, unreasonable, or unnecessary, one could video the work being done. The video of the chip-off for example could be used as notes legitimately. However, the video method is fraught with concerns and isn't very popular for note taking in many fields.

Merriora
I have worked in civil in the past, but currently work in criminal and have worked longer in criminal (U.S.A.).

If the "standards" were limited to either my points above, or very few finite points as determined by the consensus, that would be acceptable. An ISO document, as an example, for taking notes is overkill, unnecessary, and would lead to an unrealistic checklist for everyone that could not possibly be universal in real world application.

Timestamps can be embedded or manual. User preference. Both are acceptable. If you want to use a timestamp independent of instrumentation that you control (such as sending an email) to limit challenges then by all means. I'm for it and do do that in terms of communications. However, in legal proceedings it will still come down to someone's word or the trust of a note tool (if embedded) and if you didn't write it down in any fashion, then it didn't happen.

"Do you feel like there should be a timeline on when a note should be fixed (non-editable)?"

When the notes are complete, they should then be fixed in some fashion. If you are working in a productivity-driven team or an accredited lab/agency (as I do and have for most of my career) you don't get to put something "on hold." Metrics prevent that. They may be given a few days at best, but the exam is closed and the requestor is told to resubmit pending new information from them or given an explanation as to why the exam could not be completed at this present time and given options on moving forward to include closing the exam until they get us what we need to continue. Only in ad hoc shops do you have the "pick it up, put down" aspect. (Not saying its good, bad, or indifferent, just noting the difference.) I would say as long as you are recording the time then it shouldn't matter if you have gaps as long as they can be explained. In my need for thoroughness I would document such "breaks" in exam time if they were to occur.

Write-once systems prevent any sort of cleanup or fluid organization because if you make a mistake, typo, or something of the sort you can't do anything. You then have to make an additional note entry for every correction/addendum/observation that occurs. And if you copy and paste things into it you essentially defeat the purpose of writing it once. I don't see these as issues per se, just unnecessary facets of the chosen method.

For those front line officers taking paper notes, they can make changes. Usually, they must be crossed out and the change initialed. This is a typical process that I am aware of and may not be the norm everywhere. Also, they are not always mandated to submit them, just to keep them. This is a subtle but distinct difference. As far as court is concerned, scrutiny of one's notes should be expected. They should be written in anticipation of that eventuality. I dare say even welcomed, because it means they actually read them. I would also submit that if you are properly taking notes then they should withstand any scrutiny that implies wrongdoing or ineptitude. Then, scrutiny of one's method or process as documented in those notes should be expected and you should know why you do what you do and that what you do is sound or was as sound as could be done. In that instance, your notes are your cover, your substantiation, your defense as a technical practitioner, and not to be feared.

ReplyQuote
Posted : 29/05/2017 1:03 am
trewmte
(@trewmte)
Community Legend

Good feedback pcstopper. Your 2 cents worth is highly valid.

trewmte
My 2 cents…I will note that there is a clear distinction in the dictionary between contemporaneous (CN) and simultaneous (SN). They are not the same and I assert CN notes are the way to go specifically. For clarity, this means that notes are taken as soon as feasible after, or in conjunction with, the event/task being noted. It is not always feasible, or even possible, for SN notes. Now, if one were to truly challenge the notion, the answer would be yes because however impractical, unreasonable, or unnecessary, one could video the work being done. The video of the chip-off for example could be used as notes legitimately. However, the video method is fraught with concerns and isn't very popular for note taking in many fields.

The point of raising simultaneous notes is not to contradict CN but to indicate, given the complexity of the work shown in the youtube videos, digital stills or, more relevant, videoing of work undertaken can be used as supporting traceability procedures that can be referred to in the CN. Law enforcement and private labs can and do use digital stills and videoing techniques, from time to time, for a variety of reasons and have done so for many years. However, simultaneous notes, still require examiner reference back-up statements in the CN as digital stills and videoing may not be able to confirm for instance e.g. the type of chip off adaptors being used (http//www.acelaboratory.com/pc3000flash.php). Moreover, videoing is useful where chip off has taken place but a Waiver notification (no fault) is used instead of a court order (which my contacts in the States tell me videos can be used to back up the Waiver to prove no damage or any reasons why damage was caused to a phone).

ReplyQuote
Posted : 29/05/2017 1:37 am
pcstopper18
(@pcstopper18)
Member

The point of raising simultaneous notes is not to contradict CN but to indicate, given the complexity of the work shown in the youtube videos, digital stills or, more relevant, videoing of work undertaken can be used as supporting traceability procedures that can be referred to in the CN. Law enforcement and private labs can and do use digital stills and videoing techniques, from time to time, for a variety of reasons and have done so for many years. However, simultaneous notes, still require examiner reference back-up statements in the CN as digital stills and videoing may not be able to confirm for instance e.g. the type of chip off adaptors being used (http//www.acelaboratory.com/pc3000flash.php). Moreover, videoing is useful where chip off has taken place but a Waiver notification (no fault) is used instead of a court order (which my contacts in the States tell me videos can be used to back up the Waiver to prove no damage or any reasons why damage was caused to a phone).

- trewmte

Agreed. The combination of CN & SN in the situation as you described is very useful and I would say very substantive.

This, in my opinion, would support my notion that an overly burdensome standard of note taking would make even the video scenario you described untenable as there is no limit to the restrictions some would place on it in the name of "traceability" for example.

Great points.

ReplyQuote
Posted : 29/05/2017 2:56 am
Randy_Randerson
(@randy_randerson)
New Member

Big fan of One Note. Namely because it allows me to just send things over the printer to the the document for things that needed to be hand written. When I'm on scene, everything is hand written. Times don't really matter – your notes are there so a person of like experience could duplicate your methods and report if the findings were valid or not. Timestamps don't do anything unless you plan on billing your client later IMO.

For final reports, it is done in Word and printed out and then wet signature applied. It is then uploaded back to the computer and I put it in with my Case Notes to show that I had indeed completed the final paperwork for the case if the Requestor comes back and says I haven't completed it. PDF for the digital copy in the event it needs to be reprinted or distributed.

Where I work case notes are not turned over as they are a Work Product Privileged document unless there is a specific need from opposing counsel that states they are required in order to see if steps were taken that I have indeed stated in my final report were done. Even then, IF the judge approves (which they've only done so once) they are so heavily redacted they really only get mush to look at anyway.

But under no circumstance should anything be destroyed/deleted after the case is complete unless specifically requested by your counsel to do so. Seen quite a few folks in multiple countries get jammed up pretty bad because of this.

ReplyQuote
Posted : 29/05/2017 10:29 am
keydet89
(@keydet89)
Community Legend

I’m wondering if anyone has or is working on creating standards in relation to taking forensic examination notes.

IMHO, the standard should be, can you return to the examination 6 months or a year later, and reproduce the same results, given the same data? Or, can you complete the examination, and then hand your notes and the original data to another examiner, and have them produce the same results (note, I did not say "findings or interpretations based on the results…") without any additional input?

I tend to find that the pursuit of "standards" in this case is nothing more than an attempt to justify not keeping case notes at all.

For the record, I have done civil work, but never criminal. I've spent about 20 yrs as a consultant, and seen in that time that remarkably few examiners even bother to keep case notes, in any manner. I have hear some say that they keep case notes in written form, and knowing that they have a cell phone with a camera, have asked for a copy of the notes…only to never receive them.

In my experience, I have also seen where this distinction of civil vs criminal, or not at all, has been used in an exclusionary manner, such as, "…you don't do criminal work, you wouldn't understand." I've had law enforcement officers ask me a question about something, but not be able to provide example data, yet I've had other officers (law enforcement, as well as officers of the court) turn around and provide me example data. One sent me Registry hive files from a Windows 8 phone, another sent me NTUSER.DAT files from a case involving a new version of file sharing software.

Personally, I strongly believe in a write-once system that timestamps each note so that the date & time can be proven if required and that notes should be kept and provided to the courts for full disclosure.

"Proven" how? I'm sorry, but I simply do not see the reasoning here.

If you're looking for some sort of standard across the industry, to include the private sector, I'd submit that the first standard should be simply to keep them. Let's just start there.

ReplyQuote
Posted : 29/05/2017 4:20 pm
keydet89
(@keydet89)
Community Legend

I’m wondering if anyone has or is working on creating standards in relation to taking forensic examination notes.

IMHO, the standard should be, can you return to the examination 6 months or a year later, and reproduce the same results, given the same data? Or, can you complete the examination, and then hand your notes and the original data to another examiner, and have them produce the same results (note, I did not say "findings or interpretations based on the results…") without any additional input?

I tend to find that the pursuit of "standards" in this case is nothing more than an attempt to justify not keeping case notes at all.

For the record, I have done civil work, but never criminal. I've spent about 20 yrs as a consultant, and seen in that time that remarkably few examiners even bother to keep case notes, in any manner. I have hear some say that they keep case notes in written form, and knowing that they have a cell phone with a camera, have asked for a copy of the notes…only to never receive them.

In my experience, I have also seen where this distinction of civil vs criminal, or not at all, has been used in an exclusionary manner, such as, "…you don't do criminal work, you wouldn't understand." I've had law enforcement officers ask me a question about something, but not be able to provide example data, yet I've had other officers (law enforcement, as well as officers of the court) turn around and provide me example data. One sent me Registry hive files from a Windows 8 phone, another sent me NTUSER.DAT files from a case involving a new version of file sharing software.

Personally, I strongly believe in a write-once system that timestamps each note so that the date & time can be proven if required and that notes should be kept and provided to the courts for full disclosure.

"Proven" how? I'm sorry, but I simply do not see the reasoning here.

If you're looking for some sort of standard across the industry, to include the private sector, I'd submit that the first standard should be simply to keep them. Let's just start there.

ReplyQuote
Posted : 29/05/2017 4:20 pm
Merriora
(@merriora)
Junior Member

"Proven" how? I'm sorry, but I simply do not see the reasoning here.

"Proven" would be the ability to prove that a note was actually created or written at or before a certain time. With Digital Signatures and timestamps, this is possible. This isn't to say that the information is accurate, but simply written at a certain time which can go towards the credibility of the DFE if questions exist around how the search was conducted. (limited warrants, privilege information)

The question of when a note was actually written has come up in court in regards to officer notes, so this is where I draw that connection. In private industry, this doesn't seem to be a concern??

If you're looking for some sort of standard across the industry, to include the private sector, I'd submit that the first standard should be simply to keep them. Let's just start there.

I agree that as a minimum, the standard should be to keep notes. And perhaps "standard" is too strong of a word when discussing this subject?

Perhaps "Best Practice"?

I think as new DFE's enter this industry, they are looking for Best Practice advice in regards to conducting forensic exams. Most labs have their own ways of doing things and most labs have months of backlog. Hopefully by having these discussions we can find ways of improving how we conduct examinations while still using Best Practice guidelines.

ReplyQuote
Posted : 29/05/2017 6:22 pm
zhaan
(@zhaan)
Member

I really loved the 'forensic casenotes' application. BUt I dont think it is available anymore. Was a really nice program that.

There is a new version out which writes to a database and now allows adding of checklists, has a spellchecker and template feature.

We use it at the moment.

ReplyQuote
Posted : 20/06/2017 2:26 am
jhup
 jhup
(@jhup)
Community Legend

Hmmm… there was a time when I recorded my activity with time stamp tones in the recorder…
I use a four color BIC pen and steno pad. Usually transcribe it by end of day into system.

I think as others wrote, the best practice is to produce notes which can be handed to someone and they could theoretically reproduce the activity, or reasonably evaluate the validity of the activities.

When I teach this, I always bring up other branch's of forensics (forensic pathologist for example). How many completely destroy the original in the examination process? What information handed to most of the opposing side's expert?
Examiner notes.

ReplyQuote
Posted : 20/06/2017 4:15 am
Page 1 / 2
Share: