The Administrator of your Team Account has been notified.
Once final approval has been granted, you will be sent an email advising you to log in.
Please contact us to discuss your specific needs.
robert@forensicnotes.com
I recently received this question from a potential client who was looking to signup with Forensic Notes… (and eventually did).
“Is the cloud safe?”
Actually, he was a bit more direct stating “I will never put my data in the cloud”.
But I understood this strong statement to really be a question about cloud safety and if his businesses’ data would be safe in the cloud.
There are a lot of misconceptions around the cloud and how data is stored.
The problem with the term ‘cloud storage’ is that people believe that once data is uploaded to the cloud, it is available for everyone to see and share, but this couldn’t be further from the truth.
Others believe that if data is in the cloud, it is stored everywhere and therefore has a higher chance of being stolen.
As I will explain, both of these beliefs are incorrect. But given the marketing literature around the cloud, it is understandable for those of you that think this way.
Hopefully, I will be able to explain what the cloud is, why it can be the most secure place to store data and why many IT departments are against the idea of storing data in the cloud.
I will also explain situations where the cloud may not be suitable. Sometimes an On-Premises solution is your best option.
So, let’s get started.
Concerns with Cloud Storage
What are your concerns regarding cloud storage?
This was one of the first questions I asked since I wanted to fully understand the fears this client had and what was forming his opinions of the cloud.
His response was pretty simple…
“I just don’t trust the cloud and I want my data stored in my network.”
I thought this was a fair answer, but also showed he didn’t really understand that the cloud is simply a server hosted at a physical location and that for many businesses, it is a lot safer than your local computer network.
The reality is that if your organization is on the internet, then your data is already potentially accessible from the internet. For many organizations, it just takes an improperly setup firewall to give outsiders access to all your files.
So…
What is Cloud Storage?
Cloud storage, in simple terms, is a server that is hosted in a physical location and accessible via the internet.
The main cloud providers are Amazon Web Services (AWS), Microsoft Azure, IBM Cloud and Google Cloud.
But why is Amazon, Microsoft, IBM and Google investing their future in providing cloud services?
Because this is going to be a huge revenue stream for all four companies in the future.
By the end of 2018, Microsoft is expected to generate over $7 Billion in the quarter from its cloud service division. This is for a single quarter with revenue growing consistently quarter over quarter. For Microsoft, this equates to roughly 20-25% of their overall revenue.
By the end of 2019, this could be a $30+ Billion per year service for Microsoft.
As a result, Microsoft invests over $1 Billion in its Cybersecurity to secure the MS Azure network which Forensic Notes utilizes.
Why do they invest so much money in Cybersecurity?
Because they know that if client information is ever stolen as a result of their mistake, this would cause trust to quickly diminish and therefore lower future revenues.
Not only does Microsoft spend $1+ Billion a year on cybersecurity for MS Azure, but they also design the software that the majority of businesses use. As a result, they literally have access to the operating systems source code which your application runs on in the cloud. Not only this, but they have direct access to the engineers of the software should an issue arise.
As more corporations and governments move toward the cloud, the revenue generated from cloud services will make up a larger percentage of the overall revenue for Microsoft, Amazon and other cloud storage providers.
Compare this with the expertise in your IT Department and the amount your company will be spending on cybersecurity and hardware upgrades this year.
I’m not suggesting that you don’t have an amazing IT Department, but let’s be honest for a minute.
If your network engineers were the best in the industry, then don’t you think they would be working for one of the major IT companies?
The internet has allowed us to have access to experts in every field through online chats, videos and articles. The cloud gives us access to IT experts to help manage our networks and applications giving you better security than you can have on your own.
Don’t Agree?
Then I assume you are either personally running the servers and network or working for a truly amazing company with a top-notch IT Department.
If this is the case, then an On-Premises solution may be your best option. But as we will discuss below, security of your data is one reason to move to the cloud, the other is the availability of software.
More and more software companies are moving their applications to the cloud with less developed for On-Premises use.
If you are considering a cloud application, then you next question should be…
“Is the cloud application secure?”
Cloud Application Security
The security of the cloud application you are considering must be analyzed to ensure that your data will be secure within the cloud.
Not all applications are created equal and just because you trust Microsoft or Amazon to store your data and application, this does not mean that the actual application is secure.
One of the main things to consider is if the SaaS vendor is open about their security.
- Is the data encrypted?
- What additional security steps do they take to secure your data?
- Who runs the company? Can they be trusted?
Un-encrypted or improperly encrypted data either stored in the cloud or within your network could result in civil lawsuits if that data is ever exposed. You want to be sure steps have been taken to properly encrypt and secure the data.
If the SaaS Vendor is not open about how they secure your data and unwilling to answer security related questions, then I would avoid such as service. Remember, if they provide ‘marketing terms’ to discuss their security, then you are not getting the answers you need.
Don’t accept “We use military grade encryption” if they are unwilling to provide further details on what that means.
In comparison, we are fully open about how we secure your data at Forensic Notes as detailed on our Security & Data Encryption page. We are also open to any emails asking for additional information on how we secure our clients information.
If you have concerns about the security of the SaaS application you are considering, then I would look for a different service.
Security of your data should be your number one priority when looking at potential software applications and vendors.
Software Applications: Does an On-Premises Option Exist?
“I still don’t want to put my data in the cloud!”
If you still don’t want to put your data in the cloud or haven’t found a SaaS vendor that you trust, then you have to determine if the software you want to use is available for On-Premises installation.
In the past, this was common and the only way to purchase software. However, over the past few years, the majority of software vendors have moved their applications towards cloud services (SaaS = Software as a Service).
As a result, it may be difficult to find software for your organization that is:
- Current
- Secure
- Priced appropriately
Current
One of the first questions when looking at On-Premises software is to determine if the application is current. If the application has been recently developed or updated, then you must determine if the software vendor will continue to update the software in the future to fix bugs and provide feature enhancements.
If this is a considerable investment for your organization, then I would also look to see if you can sign agreements to put the source code of the application in escrow should the company close or fail to provide future updates.
A software escrow is something that we would agree to as discussed here for our larger clients.
If you can’t find any On-Premises software that meets your needs and is currently updated, then this may force you back into a cloud application (SaaS).
Deciding to go with an older application that won’t be updated will likely have major security issues and bugs which could cause major issues to your organization.
Let’s be honest, if the software was any good, they would be continuing to update it.
Don’t trust your data to an outdated system that is no longer updated.
Secure
The next item to consider when looking at On-Premises is security.
- How is the data encrypted?
- How will it be secured within your environment?
- Will the system be air-gapped on its own network or accessible from all computers, which likely has internet access?
Once again, you will want to check out the software vendors site to see what type of security they use to secure your data within their application or contact them personally to ask questions.
I hate to say this, but top cybersecurity experts agree, it is not “IF”, but “WHEN” you get breached as an organization.
And breaches don’t always come from the outside, many breaches occur internally. If an employee had access to your servers, could they download all the data stored in the application un-encrypted?
This is why data encryption is so important.
A properly developed and secured application will make it very difficult to obtain all the data and encryption keys required to decrypt the data.
Priced Appropriately
You found On-Premises software that is current and secure, but is it affordable?
A lot of current On-Premises software is developed for larger organizations and enterprises. If you are a small or medium sized business, the cost to purchase, setup and implement may be beyond your current budget. This is what makes SaaS software so attractive as the monthly costs are usually low compared to purchasing On-Premises.
The reality is that many software vendors don’t want to bother with smaller companies and therefore set their prices to only attract large organizations.
At Forensic Notes, we are committed to the smaller organizations for our On-Premises software as many of our clients are government agencies with limited budgets.
Before committing to an On-Premises application, make sure you find out the final cost to ensure it fits within your budget.
IT Department is Against using the Cloud
This is common among IT departments, especially if the employees are well established and have been within the organizations for a while.
Why is this the case?
Well, as stated above, you may work for an amazing organization that employs some of the best IT members. Your organization may also have specific needs that require On-Premises solutions.
However,…
Others may have an IT department that doesn’t like change or want to give up work as they believe it could lead to less job opportunities in the future.
In theory, the cloud allows organizations to outsource their IT services, but in reality, it simply requires that IT personnel retrain to understand the cloud and how they can work with the cloud provider to provide the most secure network they can for the organization.
Most people fear change. Your IT department is no different.
Cloud Security: Making Your Cloud Application More Secure
There are additional ways to make your cloud applications more secure depending on the options provided by the SaaS provider.
As mentioned previously, by deciding to host your data or application in the cloud, you are simply storing the data on a physical server hosted at a physical location. This is very similar to your organization connecting with another office location or allowing remote access to your systems, except…
The connection is not going through a private Virtual Private Network (VPN).
Cloud applications by default are accessible to anyone with the correct URL and login credentials. If the application thinks about security, it will also incorporate additional security systems like Multifactor Authentication (MFA) or hardware tokens to ensure only authorized users gain access to your application.
To make this setup more secure, you can incorporate a VPN from your office location to the cloud servers. This essentially takes your application off the internet and only makes it available to users accessing the application from your office location.
This is how networking works for organizations with multiple locations.
Depending on the setup, this will likely result in additional costs associated with the application both for setup and ongoing maintenance.
Conclusion
Is the cloud safe?
Yes, and I hope I showed you why. But you still need to do your research and determine if the SaaS vendor you are choosing has developed an application with security in mind.
In our case, the client who stated “I will never put my data in the cloud” happily signed up with Forensic Notes to utilize our SaaS cloud application for his organization after I was able to show him that his data would be secure.
For some organizations, On-Premises may make sense. Not only for the reasons outlined above, but it also depends on the type of data being stored.
Police departments deal with sensitive information and as a result normally work on secure air-gapped networks that don’t have access to the internet. This is where our On-Premises and Hybrid solution come in handy.
As always, if you have any questions about Forensic Notes and how we secure our clients data, please don’t hesitate to contact me directly at Robert@forensicnotes.com
If you found this article useful, please share via Social Media.
And if you think it could be improved in any way, please let me know.
Cheers,
Robert Merriott
Founder
Forensic Notes
A Paper Notebook & Pen has been the standard way to take notes for decades as it is trusted in both criminal and civil courts. Although most investigators are choosing to go with an Electronic Notebook like Forensic Notes, many individuals continue to love the feel of a good pen when taking notes.
If you plan to make handwritten notes, then here are a few tips to ensure your notes are accepted within civil and criminal courts.*
Notebook
- Bound paper notebook
No ability to add/remove pages - Numbered pages
Printed on every page - Lined
When writing in the notebook, you should utilize a high-quality pen following the ELBOWS model:
E – No Erasures
L – No Leaves torn out
B – No Blank spaces
O – No Overwriting
W – No Writing in margins
S – Statements to be written in direct speech
For general details on how to write your notes, refer to our Top 12 Best Practice Guidelines for Recording & Documenting Evidence.
Detailed Guideline for Criminal Investigators
The UK Government provides a very detailed guideline for criminal investigators in Immigration Enforcement (IE). The guideline covers how to obtain, use and store an official notebook used during investigations and is useful for anyone looking to properly use paper notebooks.
As stated within the document:
Contemporaneous notes means notes written either:
- at the time
- as soon as possible after the event
If you do not complete a notebook entry as soon as possible:
- it may not be regarded as contemporaneous
- you may not be permitted to refresh your memory from it at court
Version 8.0 – Published October 11th 2017
[ Click here to download ]Guideline Contents Overview
Contents – 2
About this guidance – 3
Contacts – 3
Publication – 3
Changes from last version of this guidance – 3
The purpose of a notebook – 4
Issuing notebooks – 5
What criminal investigators do if the usual issuing officer is not available – 5
Using notebooks – 6
Keeping contemporaneous notes – 6
The contents of a notebook – 8
Basic entry information – 8
Recording time of entry – 8
Effective use of the index – 8
When to use a separate page – 9
Blank spaces and deletions – 9
Comments or replies made by suspects – 9
Recording diagrams – 10
Taking notes if unable to use official notebooks – 11
When you may not be able to use an official notebook – 11
How you record these notes – 11
Evidence or observations taken on a Dictaphone – 11
Recording notes from SMS text messages – 12
Recording sensitive information – 13
Checking notebooks – 14
Why notebook checks must be done – 14
Keeping and storing completed notebooks – 15
Taking notebooks out of use – the officer – 15
The issuing officer – 15
Lost or stolen notebooks – 16
What the officer must do – 16
What the issuing officer must do – 16
How notebooks can be used in evidence – 17
Blue Line Magazine
“Sloppy police note taking is bad for the incourt credibility of a police witness. It undermines
the successful prosecution of a case.”
~Former Crown Prosecutor Bradford Smith
August / September 2015
[ Click here to download ]* Always check with your local courts to ensure the advice and information you find online meets the needs of the legal system in your area. The information provided in this article is not meant to be legal advice.
Below are recent interviews with clients that work in Digital Forensics and Incident Response (DFIR).
August 2018 – Digital Forensics Examiner – USA Private Industry
I recently had the opportunity to talk with “Tom” about his experiences in using Forensic Notes. Tom has been a client for over a year and had the following to say…
I haven’t been using it as much as I’d like. The “online” part of it makes it limiting in some cases. For example, I can’t use it on my forensic laptop at work because I don’t keep that connected to the Internet. But I’m sure I’m not the first person to say that.
I do use it for some personal things that I do so I can keep track of my notes.
The requirement to be ‘online’ is a common issue for those that work in an environment where the internet is restricted or not available. As a result, we have been working hard to develop our 2nd generation On-Premises software solution to solve this issue.
On-Premises does not require an active internet connection.
On-Premises & Hybrid Solutions
Click here to find out more about our On-Premises & Hybrid solutions.
However, for most of our users, they find the ability to move locations and keep their notes available to be the ideal solution.
… my frustration is really finding a good note taking application that I can use cross-platform, and has some security behind it [like Forensic Notes].
I’ve used [other note taking application] in the past, and I’ve liked it, but it’s too unstable. I was using it recently at work and the program crashed and lost all of the notes I had put in up until that point.
I’ve been using OneNote at work, but it’s just terrible at that sort of thing. I know others have used Word, Notepad, etc but I still have concerns about those products.
Since Forensic Notes can be run in any web browser, it is Cross-Platform available on Windows, Macintosh, Unix and Mobile devices.
MS Word & OneNote
Click here to view our detailed article on why you should never use MS Word or OneNote for creating contemporaneous notes during your investigation.
I like the way Forensic Notes is laid out, but again the only reason why I can’t use it more is because it has to have the Internet connection.
iOS & Android App – Offline Use
Our iOS & Android app allows user to take notes when no internet connection is available. Once an internet connection is available, all notes can be synced to the central server.
July 2018 – Digital Forensics Examiner – Canadian Police Officer
I asked the following questions:
1) Would you be able to advise what you like and don’t like about Forensic Notes?
2) What features do you use most often?
- Do you embed images within your notes?
- Take pictures/video during warrants?
- Add attachments (warrants, files)?
The Responses Follow:
Would you be able to advise what you like and don’t like about Forensic Notes?
There are two features that I really enjoy:
- The ability to access it from anywhere; multiple offices, computers and iPad.
Knowing that I can start a case at the office for a search warrant and then access the notes on scene with my iPad. - The other feature that I quite enjoy now is that you can now create a folder.
This I love! as I have a basic template for each case now;1st folder – Case Assignment/Coms with PI (Request, search warrants, any emails, etc. …)
2nd folder – Exhibits
3rd folder – Examination
4th folder – Disclosed material
Templates
Templates are a powerful feature of Forensic Notes allowing you to create and re-use portions of notes.
What features do you use most often?
As above:
- The folder option and attaching images (search warrants and usually the first overall image of an exhibit).
I haven’t used the sticky note or the note function yet as I was actually worried they would become a permanent record.
Sticky Notes (soon to be Bookmark)
The Sticky Note will NOT be included in any Forensic Notebooks downloaded. The idea of the Sticky Note is to replicate Post-it Notes used with physical paper notebooks. Post-it Notes are often used to quickly find a note or add a reminder to complete a task.
They should not include case-specific information and are therefore not included in the Forensic Notebook downloads.
Do you embed images within your notes?
Yes, I do.
Usually the search warrant and I have now started attaching the first overall image of an exhibit to its note page in the Exhibit Folder.
Take pictures/video during warrants?
I only take pictures of the actual exhibits I touch/image. The overalls are done by the IDENT folks.
Add attachments (warrants, files)?
Only exhibit pictures, warrants, and the text page the members complete requesting our service and what it is they would like us to find.
Since we only have [reporting system] and we don’t have an actual case management tool/software in our office I have been trying to lay my notes out like a poor man’s case management tool and record keeping.
Do you have any suggestions for improving Forensic Notes?
I would suggest maybe a template/note for showing chain of custody maybe? … I find that the features and the functionality you have rolled out really good and super easy to use.
Chain of Custody Template
Using the Template feature, you could easily add a chain of custody form and either fill it out electronically (with typed text) or use stylus to handwrite values onto an image of a form.
With Forensic Notes Versioning, you can then keep editing the same form, but also timestamp each change and have a clear chain of custody record with each edited version.
Steps:
1. Open the Forensic Note ZIP Archive (.zip) that you downloaded from your account.
2. Open a File Explorer window and navigate to a folder to save your files.
3. Adjust both the File Explorer window and ZIP Archive window on your screen so that you can see both at the same time (you may need to adjust the size of each window).
4. Select all files including the Forensic Note, Timestamp Certificate and attachment(s) within your ZIP Archive (.zip).
5. Drag & Drop the files from the ZIP Archive into the second (2nd) File Explorer window you opened in step 2. Files will automatically be extracted.
NOTE: You will need to enter your ZIP Archive password when extracting the files. Once extracted, your files will NOT BE PASSWORD PROTECTED. Please ensure you’ve extracted the files to a secure folder that only you can access if your notes must remain private.
We are happy to help with any questions you have regarding Forensic Notes.
Kindly provide information below and we will get back to you as soon as possible.
Or email: support@forensicnotes.com