Documenting Digital Forensics Investigations
Interested in learning how to document digital forensic investigations? Forensic Notes was built for exactly this type of task.
Learn more at: https://www.forensicnotes.com/how-to-...
Your reputation impacts the weight of your testimony…
Which can have legal repercussions for any Digital Forensics Investigation you are involved in.
Having the court find fault in your testimony ...
or not following best practices during an investigation can have negative consequences for the rest of your career.
ou are EXPECTED to be a neutral and independent expert who provides opinions based on facts not what your client wants you to say.
As a Professional Digital Forensics Expert
You must follow industry best-practices.
This includes documenting your investigations Contemporaneously.
Contemporaneous Notes are required by all the leading
Digital Forensics guidelines.
Here are whatLeading DFIR Organizations have to say;
Scientific Working Group on Digital Evidence:
-------------------------------------------------
"Examiners should take contemporaneous notes ... [and] maintain any notes with their case for later review."
*Source: SWDGE Best Practices for Computer Forensic Examination
Assoication of Chief Police Officer (UK)
----------------------------------------
"...full records should be made of all actions taken [and]
these must be disclosed to the defense"
*Source: Good Practice Guide for Digital Forensics - ACPO UK
ISO/IEC 27042:2015
-------------------
"In many jurisdictions, it is necessary for contemporaneous notes to be handwritten in non-erasable in tamper-evident notebook to assist with issues of non-repudiation and admissibility."
*Source: Guidelines for Analysis and Interpretation of Digital Evidence.
Forensic Science Regulator (UK)
------------------------------------
"As with most activities in forensic science, contemporaneous notes are required."
*Source: Method Validation in Digital Forensics
ISO/IEC 17025:2015
----------------------
"Observations, data, and calculation shall be recorded at the time they are made."
*Source: General Requirements for the Competence of Testing and Calibration Laboratories
General Requirements for the Competence of Testing and Calibration Laboratories
Use a system built specifically for keeping and protecting your
contemporaneous notes!
Learn about the Forensic Notes difference!
https://www.forensicnotes.com/
