Contemporaneous note (CN) taking is an essential process and procedure. The title is often used as a widely applied statement to include other associated processes and procedures, such as Simultaneous Notes (SN), etc.; as some of you know CN, SN, IN and VN are covered in my training courses for e-Discovery, (forensic) examination and evidence E3.
I have taken the opportunity to bring on board Robert Merriott, Founder of Forensic Notes, to provide an overview of some of the methods and tools out there for preparing and producing Contemporaneous Notes. From Robert's well informed discussion (below) this clearly is a subject where strong opinions are held and a subject which we will return in future discussions.
Robert Merriott
Digital Forensic Examination Notes
The purpose of this post isn’t to provide a
singular and definitive answer to the question of what ‘examination notes’
should look like. In fact, every
country or region will have its own accepted practices developed to satisfy the
laws of the land. Instead, this article
is presented to discuss the many facets of this important subject and to help
you find a solution that will best meet your needs.
A recent
discussion regarding Contemporaneous Notes on Forensic Focus showed that
there are differing views on how strict guidelines should be in relation to
examination notes. This difference of
opinion reveals how much the process of conducting digital forensic
examinations can vary from one office to the next.
Importance of Documentation
The importance of documenting your
examinations can not be understated.
Although you may never need to defend your case in court, you should
complete every case as if you would be testifying as an expert in Supreme
Court.
As Greg stated…
“Contemporaneous
Notes are unavoidable, thus inescapable, when it comes to examining evidence
and are akin to the standard of Ethics.
They hold the
examiner to their own account of conduct when no one else is around to witness
what is happening.”
Examination Notes – Current Solutions
Investigators dealing with digital evidence
will document their examinations in one of several ways:
-
Traditional paper notebook and
pen
-
Word processors such as MS Word
or OneNote
-
Purpose built electronic note-taking
system
-
Scrap pieces of paper
-
Do not document!
Paper Notebook and Pen
The classic way of writing contemporaneous
notes.
This form of documentation has been relied upon
in law enforcement and scientific labs for decades and has continued to standup
to the scrutiny of the courts when properly completed.
Although widely accepted in courts, writing
your notes in a paper notebook can be slow and result in notes that are
illegible and incomplete. For many young
examiners that can quickly type out long messages on a virtual mobile keyboard,
the idea of handwriting notes seems like a step back in productivity.
Attempts to correct spelling and grammatic
mistakes only further complicate the process of writing and disclosing notes.
MS Word or OneNote
Electronic documentation is becoming more
common even in traditional settings like law enforcement were only paper notebooks
and pens were previously trusted.
Electronic documentation offers many
advantages including the ability to edit and modify the content of the notes as
required.
Being able to edit the content of an
electronic note allows the examiner to correct any spelling, grammatical errors
or omissions. As a result, some examiners feel electronic documentation provides
a more professional form of their notes as they are able to correct these
issues prior to providing them to colleagues or the courts.
But if notes can be changed at a later date
with no previous history of the contents originally entered, can they really be
considered contemporaneous?
And does this open up Pandora’s Box for defense
lawyer questioning?
If you admit you modified some of your
notes for “grammar” and “typos”, will defense begin to argue you changed other
aspects of your notes as well? And what
if you did change something else for reason beyond simple grammar or typos, how
will you explain that change in court?
Criminal courts would never allow a law
enforcement officer to wite-out® portions of
his notes in a paper notebook and then overwrite that information with new information.
So why should the courts trust electronic notes to be a true representation of
your thoughts at the time stated if they can be edited without including the
previous entries?
Although many Digital Forensic Examiners
are using MS Word and OneNote successfully in courts throughout North America
and Europe, we as examiners know that the majority of courts have failed to
keep up with the complexities of digital data and how easily files can be
manipulated.
Of course, there are ways to make
electronic notes immutable with the use of Digital Signatures and digital
timestamps, but few organizations are properly setup to implement this solution.
Will you be able to defend the authenticity of
your MS Word or OneNote examination notes in court if questioned?
Electronic Note-Taking Application
Electronic Note-Taking applications offer
the best of both worlds if designed and used properly. But remember, not all applications are
created equal.
When deciding on what electronic
note-taking application you want to use, you will have to consider your
specific needs and requirements not only now, but in the future when your cases
finally go to trial.
-
Can you easily print notes in
sequential order for court?
-
Can you edit existing notes
while retaining the original note for Full Disclosure?
-
Can you arrange your notes in a
logical manner during the investigation to keep your information organized?
-
Can you search through your
notes to find answers quickly?
-
Is your information securely
saved and encrypted?
-
Do Audit Logs exist allowing
you to clearly see who else accessed a particular note or notebook?
-
Is the application able to
timestamp individual notes from a trusted and independent Timestamping
Authority (TSA)?
-
Will the courts be able to
authenticate your notes if required without calling in another expert?
-
Can you access your notes on
multiple devices, including mobile, so that you can take notes outside of your
office such as during live analysis at the scene or meetings with other
investigators?
-
If you include screen captures
and images in your notes, will you be able to print the image in a high-quality
format at a later date if it becomes a key piece of evidence?
-
Are the owners of the
application trusted members of the digital forensic community?
When choosing an Electronic Note-Taking Application,
you should select an application that works the way you work instead of being
forced to work within the constraints of the application they provide.
Scrap Pieces of Paper
Although it’s common to use scrap pieces of
paper to quickly jot down information, they should not be used as a place to
write notes during an examination unless other options discussed above are not
available.
If scrap pieces of paper are used to
document important information, this should be transcribed into your proper
notes as soon as possible. Often, if done in a reasonable time frame, these
transcribed notes will be considered contemporaneously written.
Do Not Document Examination
Some examiners do not see a need to
document their examinations. This is often as result of poor training,
inexperience or laziness. If your examination involves criminal or civil
litigation, then it’s imperative that you conduct your examinations in a
professional manner. Poorly documented
investigations can lead to bad caselaw that affects us all.
Should Standards Exist for Examination Notes?
Preston Coleman provides a valid and well
thought out response to the idea of standards for examination notes.
As Preston points out, if standards were to
be created for examination notes, then they should be general in nature to
allow for the flexibility needed within most examinations. At a minimum, the following “universal
elements should be observed”
-
Contemporaneous Notes
Document actions and results sequentially as they occur
-
Timestamp Notes
Include Date & Time with every note made
-
Immutability
Notes should be fixed and non-editable upon completion of the examination
-
Available
Provide to others, including the courts, if required
Depending on your particular circumstances
and the types of files that you are investigating, you may decide on more
stringent requirements for your own note taking.
Odds n’ Ends
Now let’s discuss a few more questions
regarding examination notes…
Simultaneous Notes
As discussed within the “Forensic Chip Off
– Notes in Progress” post,
Greg asked the question “how would you keep contemporaneous notes (CN)
simultaneously whilst removing a chip?”
If Simultaneous Notes (SN) were required
during a technical hands-on examination, then a video of the examination (as
shown in the blog post) could be used to allow the examiner to concentrate on
the task at hand while still properly documenting the actions being taken. Upon
completion, the video file could be hashed with the resulting hash being noted
within your Contemporaneous Notes.
A purpose-built forensic Electronic
Note-Taking application would allow you to attach the original video to the note
and automatically Hash and Timestamp the video in only a couple steps.
Destroy Notes After an Examination Is Complete?
In some American states, it is apparently
common practice to destroy both paper and electronic notes once a final
examination report has been written.
If the destruction of examination notes is
currently allowed where you work, you should ask yourself:
-
What happens if the accuracy or
credibility of the report is questioned?
-
What reasoning will you provide
if questioned on why you felt it was necessary to destroy your notes?
o
The opposing party may ask
“What were you trying to hide in those notes that it was so important that you
destroy them prior to court?”
Restrictive Warrants
In many regions, warrants authorizing
forensic examinations are becoming restrictive with respect to the type of data
that can be analyzed and included in forensic reports. In practice, you may observe other evidence
in plain view (eg: Child abuse material) that does not fit within the
restrictions of the warrant.
In this case, it is suggested that you
immediately stop your current examination and re-apply for a warrant that
includes the evidence you observed in plain view.
If you fail to take proper contemporaneous
notes or destroy your notes upon completion of a report, would you be able to
properly articulate how you came to observe the images or data that you weren’t
authorized to have searched which resulted in a more comprehensive warrant
being sought?
If not, you risk having all your evidence
excluded from the trial.
Many investigators fail to recognize that
obtaining a new warrant is easy in comparison to defending the merits of the
new warrant at trial. Are you willing to lose all that hard work due to a lack
of proper documentation?
Conclusion
The digital forensic community needs a “Best
Practice” guideline in creating contemporaneous notes during an examination.
Without a clear guideline, Digital Forensic Examiners are left to rely on
potentially false or misleading information from fellow members who do not
fully recognize the need or value in creating proper notes during an
examination.
At a minimum, all professional Digital
Forensic Examiners should use the following list as the current “Best Practice”
guideline:
-
Contemporaneous Notes
-
Timestamp Notes (Date &
Time)
-
Immutability
-
Available
By continuing to discuss this important
subject, we as a community can further improve “Best Practice” guidelines that
will help ensure existing and new examiners take the necessary steps during
digital forensic examinations.
After evaluating the “Best Practice”
guidelines, you can make an informed decision on what is the best solution for
recording Examination Notes given your particular circumstances and needs.
About
Author:
Robert Merriott founded TwiceSafe Software
Solutions Inc. (Forensic Notes) after realizing the need for a digital
note-taking application that would meet the high standards of digital forensic
evidence in the courts. Robert has a Degree in Computer Information Systems and
obtained both Microsoft MVP and ASPInsider status during the infancy of
ASP.Net. He now works as a Digital Forensic Examiner.
DISCLAIMER:
This article is not meant to provide legal advice or information. Legal
statements made are only provided as guidance for the reader to seek
professional legal advice within their jurisdiction. No information contained
within this article should be acted upon without discussing the merits of such
information with a legal professional. The author of this article is NOT A
LAWYER and takes no legal responsibility for the information presented. In
addition, the information provided is based on personal beliefs and ideas and
does not represent his employer.
