Contemporaneous notes for digital forensic examinations

Given the complexity of many examination-scenarios, practitioners in the field of digital forensics should consider the production and maintenance of contemporaneous notes a core part of any examination process. Not only do contemporaneous notes support the practitioner as they conduct their case work, through to the production of any accompanying report, but in some instances disclosure of this information may be required in order for all parties to evaluate any evidential findings fully. This work discusses the need for, and role of, contemporaneous notes in digital forensics, where a 'skeleton' of content outlining the required information practitioners should look to include in their contemporaneous notes is offered. (c) 2021 Elsevier Ltd. All rights reserved.