Contemporaneous notes

"If it was not written down, it did not happen" is an exaggeration, but it is close to how reviewers and courts treat forensic work. Contemporaneous notes are notes made at the time of an action, or as soon as practical afterwards, by the person who carried it out. They are the examiner's own record of what was done, with what, and why. This lesson covers what to record, how to keep notes on paper or electronically without undermining their integrity, and why they matter in peer review and in court. How notes feed into the final report is covered in Module 7.

What contemporaneous means

Contemporaneous means made at the same time. A note written while imaging a drive, or immediately after, records what the examiner saw; a note written from memory a week later records what they remember, which is less reliable and easier to challenge. When an entry cannot be written at the time, for example during a fast-moving search of premises, it is written as soon as possible and says when it was written. Notes are not the report. They are the raw record from which the report is written, and against which it can be checked.

What to record

• Date and time with time zone for every entry, for example 14:32 UTC+02:00. When it matters, also record the time shown by the device under examination compared with a reliable reference clock (Module 6).
• Actions: what was done, to which item, identified by its exhibit number.
• Tools and versions: the hardware and software used, with version numbers, including the write blocker and the workstation.
• Settings: options chosen, such as image format, segment size, hash algorithms and search terms.
• Observations: what was seen, such as a program running, a message on screen, damage, labels and serial numbers.
• Results: hash values written in full, error messages, and counts of items found.
• Problems and decisions with reasons: anything that did not go to plan, what was decided and why, including options considered and rejected.

Record what you did not do as well, when it matters. "Memory not captured: laptop was switched off on arrival" answers a question before anyone asks it.

Paper or electronic

Bound notebooks

The traditional choice is a bound notebook with numbered pages, written in permanent ink. Pages are never torn out and entries are never erased or overwritten. A mistake is corrected with a single line through the wrong text, so that it stays readable, followed by the correction, the date and the writer's initials. Blank space at the end of an entry or page is crossed out so that nothing can be added later, and each page is dated and initialed.

Electronic notes

Typed notes are easier to read and search, and they can hold hash values and file paths copied exactly from tool output. They need equivalent protections: automatic timestamps; a history that keeps every change instead of replacing text, such as a version-controlled repository or a case system that retains previous versions; and a way to show the notes were not altered later, for example by recording a hash of each day's file or saving it to write-once media. A word-processor file that anyone can edit without a trace is a weak record. The logs that tools produce are kept alongside the notes, which refer to them rather than replace them.

How to write them

Notes should be readable by someone who was not there, including a reviewer, a lawyer or the examiner years later. Write facts and observations, and label any opinion or inference clearly as such. Use abbreviations only if they are standard in your organization or explained in the notes. Every person who carries out an action writes their own notes; if a colleague records actions for someone else, for example while that person handles a device, the note says who did what and who wrote it. Notes are part of the case file, and they may be disclosed, so write nothing in them that you would not be willing to explain in court.

Photographs and screen recordings

Images often record a scene or a screen better than words. Photographs of a device as found, of its labels, ports, packaging and seals, and of what its screen displayed are part of the notes. During live work on a running system, a screen recording, or a camera filming the screen, shows exactly what was typed and what appeared. Keep the original image and video files, record their hash values, and refer to each one by number in the written notes so that the two can be read together. A photograph does not explain itself: the note says what it shows and why it was taken.

Why notes matter

Notes are what make the handling aspects from Module 1 achievable in practice.

• Repeatability and reproducibility depend on knowing exactly which tool, version, settings and inputs produced a result. Without that, nobody, including the original examiner, can run the same steps again.
• Justifiability depends on recorded reasons. A decision that looks odd a year later, such as imaging only part of a server, is defensible if the notes show the constraint that forced it.
• Peer review, in which a second examiner checks the work before the report is issued, works from the notes and tool logs, not from conversation.
• Testimony may come months or years after the examination. Examiners rely on their notes to answer accurately, and the notes may be disclosed to the other party, who will read them closely.

Consider Tomás Vidal, a fictional examiner asked in court why he did not examine one partition of a drive. His notes read: "Partition 3 encrypted, no key supplied. Key requested from case officer 10:15 UTC; officer replied 11:40 that none is available." His answer is immediate and credible. Without the note, he could only say that he does not remember.

Good and poor notes

Exam focus: Know what contemporaneous means (made at the time, by the person who acted) and what an entry contains: date and time with time zone, item identifier, action, tool and version, settings, observations, results such as full hash values, and problems and decisions with reasons. Know how integrity is protected: bound notebooks, permanent ink, single-line strike-through with date and initials, no erasing, and timestamped, version-controlled or write-once electronic notes. Expect questions linking notes to repeatability, reproducibility, justifiability, peer review and testimony.