I’m wondering if anyone has or is working on creating standards in relation to taking forensic examination notes.
IMHO, the standard should be, can you return to the examination 6 months or a year later, and reproduce the same results, given the same data? Or, can you complete the examination, and then hand your notes and the original data to another examiner, and have them produce the same results (note, I did not say "findings or interpretations based on the results…") without any additional input?
I tend to find that the pursuit of "standards" in this case is nothing more than an attempt to justify not keeping case notes at all.
For the record, I have done civil work, but never criminal. I've spent about 20 yrs as a consultant, and seen in that time that remarkably few examiners even bother to keep case notes, in any manner. I have hear some say that they keep case notes in written form, and knowing that they have a cell phone with a camera, have asked for a copy of the notes…only to never receive them.
In my experience, I have also seen where this distinction of civil vs criminal, or not at all, has been used in an exclusionary manner, such as, "…you don't do criminal work, you wouldn't understand." I've had law enforcement officers ask me a question about something, but not be able to provide example data, yet I've had other officers (law enforcement, as well as officers of the court) turn around and provide me example data. One sent me Registry hive files from a Windows 8 phone, another sent me NTUSER.DAT files from a case involving a new version of file sharing software.
Personally, I strongly believe in a write-once system that timestamps each note so that the date & time can be proven if required and that notes should be kept and provided to the courts for full disclosure.
"Proven" how? I'm sorry, but I simply do not see the reasoning here.
If you're looking for some sort of standard across the industry, to include the private sector, I'd submit that the first standard should be simply to keep them. Let's just start there.
I’m wondering if anyone has or is working on creating standards in relation to taking forensic examination notes.
IMHO, the standard should be, can you return to the examination 6 months or a year later, and reproduce the same results, given the same data? Or, can you complete the examination, and then hand your notes and the original data to another examiner, and have them produce the same results (note, I did not say "findings or interpretations based on the results…") without any additional input?
I tend to find that the pursuit of "standards" in this case is nothing more than an attempt to justify not keeping case notes at all.
For the record, I have done civil work, but never criminal. I've spent about 20 yrs as a consultant, and seen in that time that remarkably few examiners even bother to keep case notes, in any manner. I have hear some say that they keep case notes in written form, and knowing that they have a cell phone with a camera, have asked for a copy of the notes…only to never receive them.
In my experience, I have also seen where this distinction of civil vs criminal, or not at all, has been used in an exclusionary manner, such as, "…you don't do criminal work, you wouldn't understand." I've had law enforcement officers ask me a question about something, but not be able to provide example data, yet I've had other officers (law enforcement, as well as officers of the court) turn around and provide me example data. One sent me Registry hive files from a Windows 8 phone, another sent me NTUSER.DAT files from a case involving a new version of file sharing software.
Personally, I strongly believe in a write-once system that timestamps each note so that the date & time can be proven if required and that notes should be kept and provided to the courts for full disclosure.
"Proven" how? I'm sorry, but I simply do not see the reasoning here.
If you're looking for some sort of standard across the industry, to include the private sector, I'd submit that the first standard should be simply to keep them. Let's just start there.
"Proven" how? I'm sorry, but I simply do not see the reasoning here.
"Proven" would be the ability to prove that a note was actually created or written at or before a certain time. With Digital Signatures and timestamps, this is possible. This isn't to say that the information is accurate, but simply written at a certain time which can go towards the credibility of the DFE if questions exist around how the search was conducted. (limited warrants, privilege information)
The question of when a note was actually written has come up in court in regards to officer notes, so this is where I draw that connection. In private industry, this doesn't seem to be a concern??
If you're looking for some sort of standard across the industry, to include the private sector, I'd submit that the first standard should be simply to keep them. Let's just start there.
I agree that as a minimum, the standard should be to keep notes. And perhaps "standard" is too strong of a word when discussing this subject?
Perhaps "Best Practice"?
I think as new DFE's enter this industry, they are looking for Best Practice advice in regards to conducting forensic exams. Most labs have their own ways of doing things and most labs have months of backlog. Hopefully by having these discussions we can find ways of improving how we conduct examinations while still using Best Practice guidelines.
I really loved the 'forensic casenotes' application. BUt I dont think it is available anymore. Was a really nice program that.
There is a new version out which writes to a database and now allows adding of checklists, has a spellchecker and template feature.
We use it at the moment.
Hmmm… there was a time when I recorded my activity with time stamp tones in the recorder…
I use a four color BIC pen and steno pad. Usually transcribe it by end of day into system.
I think as others wrote, the best practice is to produce notes which can be handed to someone and they could theoretically reproduce the activity, or reasonably evaluate the validity of the activities.
When I teach this, I always bring up other branch's of forensics (forensic pathologist for example). How many completely destroy the original in the examination process? What information handed to most of the opposing side's expert?
Examiner notes.
In case you have used Case Notes previously, here is the newest version
https://
As a result of the discussions on this forum and with industry leaders, I wrote an article on The Importance of Documentation which is now available on
The purpose of the article isn’t to provide a singular and definitive answer to the question of what ‘examination notes’ should look like. Instead, the article is meant to further open up the discussions on what is acceptable in your area and see if we can work towards ‘best practices’ in the industry. This can help all of us as bad case-law in one region can quickly transform the legal landscape across your respective countries.
Please post your comments to the article in this thread including the aspects that you agree and disagree with.
- What legal concerns do you have in regards to your examination notes?
- What are your thoughts on a 'Best Practice'?
The purpose of the article isn’t to provide a singular and definitive answer to the question of what ‘examination notes’ should look like. Instead, the article is meant to further open up the discussions on what is acceptable in your area and see if we can work towards ‘best practices’ in the industry.
With all due respect, it seems like your article is essentially about how good your product is, and how better it is than any other method.
Mind you, I am not in any way saying that your product is not the third best thing in the world after ice cream and sliced bread, or that the other considerations on methods/procedures are not extremely valid, only that it can be easily (mis)taken as one of the various promotion/astroturfing pieces that are already all over the net.
Once said this - and again with all due respect - the idea of having *anything* of actual value accessible "from everywhere" (as is - at least partially and if I get it right - on the cloud) via Facebook, Google or similar is very different from what I would envision as "safe" or "protected".
Working on an air-gapped PC inside a faraday cage in an underground rebar concrete bunker with 5" thick steel doors is more like it wink .
jaclaz
Just a couple of points to make about the article. I haven't used Forensic Notes and not connected with it. I was though happy to run the article as it highlights a wide disparity in techniques in use when it comes to features and securing content.
Why are so many products lacking securing data integrity?
Moreover, with ISO17025, the CPS guidelines, FSR guidelines and so on all indicating the importance to produce notes contemporaneous to the time of examination etc.; if these bodies and guidelines had intended notes could be altered surely they would say so?
Is there a suggestion Forensic Notes has gone over-board with features and securing data or is it the case the product reflects customer demand but which reflects that their customers have legal requirements if they use such a product?
I note John Douglas' Case Notes is not in the mix of the article. How does that solution compare to Forensic Notes?
Lastly, I think Rob has endevoured to report fairly on various techniques out there and in use so that is educationally helpful.
[Reason for correction I was typing on my smartphone and my fingers are bigger than the phone's keys, so typos corrected.]
Hey Jaclaz
I appreciate your reply. Honestly, I do not want to turn this thread into a discussion about my product, but about note taking in general and the solutions that exist which is the intention of the article. To keep this discussion going to see if "Best Practices" can be agreed on for those that are working in smaller forensic units and do not have SOPs in place. To hear reasons for and against different methods, including against solutions like mine.
There are pros and cons to every service which I attempt to point out. Mine may not be for everyone especially in an air-gapped bunker underground. ;-). For others, it may be a solution like OneNote, Word, CaseNotes or trusty paper notebook. As far as my product is concerned, I am simply hoping to create something of value to the forensic community.
This is meant to be an open discussion so that people that are looking for a solution can read the discussions and determine their best solution given their particular requirements.
From this thread and numerous discussions, I have learned a lot in regards to note taking which I was not aware of prior. Thank you to everyone that has shared their views. The difference in opinions and what should and should not be included in notes has been eye-opening, especially as we all deal with ever increasing workloads.
Cheers.