It is up to the judge or jury to determine how much ‘weight’ they are going to put on the testimony you provide which will be based on how credible you appear while testifying. We have to remember that the reliability of a testimony is not binary, in that it is believed or not believed. The judge scolded the prosecutor for failing to take detailed notes at the time of an important conversation with these two officers. In the court case below, a prosecutor had taken the stand to defend her actions to charge two officers for ‘attempt to obstruct justice’. Will your evidence have any credibility without notes?Īnd when it comes to court, even lawyers are expected to take contemporaneous notes. If this happens, will you be able to remember the details of an investigation that occurred 12 – 36 months prior? If you didn’t write your notes contemporaneously, the judge may rule that you are not able to refer to your notes while on the stand. This is especially true if those notes include screen captures of results during the investigation.Īnd if you are going to make notes, they should be made contemporaneously to the examination as this has more weight within criminal and civil court should you find yourself on the stand. As a result, some DFIR Examiners say they aren’t really required if no one asks for them.īut as a professional, should you be looking for shortcuts to complete your DFIR investigations?Īnd would failing to create documentation even save time in the long run?Īt some point during your investigation, you will likely have to write a report explaining your findings which is a lot easier to complete when you have detailed notes to refer to. The reality is that contemporaneous notes are often not completed nor are questions raised about their absence. I believe that most professionals within the DFIR community understand that Contemporaneous Notes are a requirement based on professional training and recommendations by Digital Forensic Guides and leading DFIR Organizations.

Some Digital Forensic Examiners even question if they are actually required when conducting Digital Forensics and Incident Response (DFIR) investigations. There are contradicting views on what Contemporaneous Examination Notes are and how they should be written. Experts Agree – Documenting DFIR Investigations is Importantĭestroy Notes After an Examination is Complete?

Notes word