Category:

Uncategorized

IACIS

by Michael Post

Here is some information to help you get quickly signed up and using Forensic Notes.

Sign-Up

Signing up for Forensic Notes is simple.  Click on Start Free Trial and select the Professional Account, and follow the sign-up instructions using your IACIS email address. We will recognize the email address and automatically upgrade your account to Professional at not cost.

No payment information required.

Getting Started

Watch our short introduction video below on how begin creating your first notes with Forensic Notes.

Contact Us

If you have any questions or run into any issues, please email [email protected].

We are ready to help you with any issues you have, and usually respond within an hour between 6am – 9pm PST.

We also love to hear any feedback from your experience using Forensic Notes.  Please don’t hesitate to let us know you like or what we improve.

 

IACIS-Discount

by Michael Post

IACIS Members Save 15%
www.ForensicNotes.com/IACIS-Discount

We are excited to be a Gold Sponsor of IACIS 2021.

All IACIS members can get a 15% discount to Forensic Notes.
Simply go to our pricing page and select Professional.

Once you sign up, email [email protected] with the email you used to signup and confirmation that you are an IACIS member.

We will then send you a discounted invoice.

This is valid for individual and team accounts until May 31st, 2021.

If you signup during the IACIS 2021 event ending May 7th, 2021, we will give you an extra 10% discount for a total of 25% off.

If you have any questions, please do not hesitate to contact me.

Cheers,
Robert Merriott
Founder of Forensic Notes

Robert-Merriott-Profile-Picture
"Forensic Notes makes documentation easy from the beginning through the end of a case."
Brett Shavers
Brett ShaversDigital Forensics Practitioner, Author, and Instructor
"I also agree wholeheartedly with Forensic Notes reasoning on why not to use MS Word and OneNote and instead use Forensic Notes."
Harlan Carvey
Harlan Carvey Author of “Investigating Windows Systems” & RegRipper
"I wish I had a tool like this years ago.
From a best practices standpoint, it compels examiners to carefully and contemporaneously document their efforts."
Alan Nelson
Alan NelsonFounder & Managing Director - Nelson Forensic & Advisory Services
"From intake to investigation, Forensic Notes solves a critical problem in OSINT investigations: having bulletproof notes.

Save yourself the headache and embarrassment, and start taking Forensic Notes."
Justin Seitz
Justin SeitzFounder of Hunchly OSINT Software
"Unlike almost all of the software programs we currently use this was created by/for law enforcement."
James
JamesPolice Officer / Investigator
"Forensic Notes is employing all best practices in securing their application and the data that exists within it."
Mike Parsons
Mike ParsonsSecurity Evangelist
"Forensic Notes will help to ensure that we can focus on issues of importance and not get sidetracked on problematic notes."
Jonathan W. Hak, Q.C.
Jonathan W. Hak, Q.C.Expert Witness & Investigator Testimony Instructor; Barrister and Solicitor
Previous
Next

See how Forensics Notes can help your Digital Forensics Investigation

Watch the video below and see how easy it is to begin creating your own Forensic Notes.

Keyboard Shortcuts

by robAdmin

You can use the following key shortcuts when adding or editing notes.

ActionsKeyboard shortcuts
Toolbar focusalt + f10
Insert linkctrl + k
Insert imagectrl + shift + i
Insert tablectrl + shift + e
Undoctrl + z
Redoctrl + y
Copyctrl + c
Cutctrl + x
Pastectrl + v
Boldctrl + b
Italicctrl + i
Underlinectrl + u
Strikethroughctrl + shift + s
Uppercasectrl + shift + u
Lowercasectrl + shift + l
Superscriptctrl + shift + =
Subscriptctrl + =
Indentsctrl + ]
Outdentsctrl + [
HTML sourcectrl + shift + h
Fullscreenctrl + shift + f
Justify centerctrl + e
Justify fullctrl + j
Justify leftctrl + l
Justify rightctrl + r
Clear formatctrl + shift + r
Ordered listctrl + shift + o
Unordered listctrl + alt + o

Report-A-Bug

by Michael Post

We are sorry, looks like you found a bug.

Our team will work to resolve any reported bugs, so please let us know what happened.

The more information you give us – the faster we can fix the problem.  

Please see the email tab below.

Short on time?

Select the form tab below to give us a quick summary of what happened.

Forensic Notes Validation Tool

by Michael Post

Prove the Authenticity of Your Documents

Our proprietary Validation Tool below will allow you to prove the date & time you created a Forensic Note, and that the documents have been unaltered. This includes being able to verify all of your:

  • Forensic Notebooks
  • Individual Forensic Notes
  • Attachments added to your Forensic Notes
Launch Forensic Notes Validation Tool

Test Forensic Note Validation

Below are three (3) files you can use to test the validation system.

1. Valid Forensic Notebook

2. Valid - But Older Outdated Forensic Notebook

The following Notebook is Valid, but additional change(s) were made to the electronic version of the Notebook within the Forensic Notes application which results in the following Forensic Notebook being valid, but outdated (Yellow).

Changes may include the user adding a new Forensic Note or marking an existing Forensic Note as deleted.

FACT: This is similar to Photocopying the notes within a paper notebook, but then adding a new note to the paper notebook afterwards. The existing photocopy is valid; it just doesn’t include all the information currently contained within the paper notebook which could be essential to your particular incident.

3. Invalid Forensic Notebook

The following Notebook was modified within Adobe Reader and is therefore NOT valid.

Launch Forensic Notes Validation Tool
Fake Notes

Fake Notes?

by Michael Post
Fake Notes
Play Video

“Watch out for people that take so-called “notes,” when the notes NEVER EXISTED until needed”

To avoid possible false allegations, contemporaneous notes should always be timestamped in a trusted note-taking system so that the writer can PROVE when they were written.

This eliminates the allegation of ‘fake’ notes that were created “when needed”.

The US President, Donald J. Trump recently tweeted…

Trump's Tweet on Fake Notes

The key statement within this tweet is his claim that the “notes never existed until needed”.

Can we determine when these “notes” were created?

You may be surprised to learn that using popular word processing applications may leave this question unanswered.

However, it would be very easy, if they were created in an immutable system like Forensic Notes!

President Trump makes a valid and interesting point about contemporaneous notes and those that claim to have written them. Being able to independently verify when they wrote the note is a key component to their credibility.

Taking good notes matters.

PROVING when you took good notes matters even more.

This is why Forensic Notes was created.

Forensic Notes allows you to create notes while ensuring you can always PROVE when you wrote them.

From a technical perspective, every note is Digitally Signed and Timestamped, using the same technology used by major banks and government agencies.

Simply put…

After you write a note, it is made immutable (can’t change) and it includes the date/time of when it was written.

This is similar to the idea of placing the note on the blockchain, which is often in the news.

And like the blockchain, anyone with a copy of your notes could simply drag & drop your notes on our verification page to confirm the notes were the originals and unaltered.

As more information comes out on how these notes were written, we will see if the authors are able to PROVE when they were written. Perhaps they used Forensic Notes?

Interested in protecting your credibility?

Signup with Forensic Notes Today!

Forensic Witness – Error

by robAdmin

Sorry, it looks like you encountered an error with Forensic Witness.

Please try again. If you continue to encounter this issue, please contact the investigator who provided you with the link to the application.

Final Approval Required
to Join Team

by robAdmin

The Administrator of your Team Account has been notified. 

Once final approval has been granted, you will be sent an email advising you to log in.

Extract Forensic Notes from ZIP

by robAdmin

Steps:

1. Open the Forensic Note ZIP Archive (.zip) that you downloaded from your account.

2. Open a File Explorer window and navigate to a folder to save your files.

3. Adjust both the File Explorer window and ZIP Archive window on your screen so that you can see both at the same time (you may need to adjust the size of each window).

4. Select all files including the Forensic Note, Timestamp Certificate and attachment(s) within your ZIP Archive (.zip).

5. Drag & Drop the files from the ZIP Archive into the second (2nd) File Explorer window you opened in step 2. Files will automatically be extracted.

NOTE: You will need to enter your ZIP Archive password when extracting the files. Once extracted, your files will NOT BE PASSWORD PROTECTED. Please ensure you’ve extracted the files to a secure folder that only you can access if your notes must remain private.

 

Extract Forensic Notes from ZIP Archive | Forensic Notes Software

Contact Us

by robAdmin

We are happy to help with any questions you have regarding Forensic Notes.

Kindly provide information below and we will get back to you as soon as possible.

Or email: [email protected]

Adobe Reader or Adobe Acrobat Validation

by robAdmin

Adobe Reader / Acrobat Validation NOT Always Required!

The instructions within this article are provided to validate a Forensic Note via Adobe Reader or Adobe Acrobat. However, validation via the Forensic Notes Proprietary Validation Tool is recommended due to its ease of use and validation capabilities.

 

1. Open a Forensic Note / Notebook within Adobe Reader or Acrobat and ensure that the “Valid Forensic Note” signature panel is displayed (see below). If Digital Certificate has not been trusted, go to Trust Digital Signing Certificate and follow the instructions before proceeding.

2. Confirm that the PDF has been Digitally Signed by [email protected]

3. Confirm that the document has not been modified since the signature was applied.

4. Confirm that the signing time of the document approximately matches the time you have recorded within the Forensic Note or Forensic Notebook. To view the signing time of the Forensic Note, you must “Show Signature Properties…”.

Dates & Times – Why Approximately?

 

While validating a Forensic Note or a Forensic Notebook, up to three (3) different dates & times may be found which will all be valid if they fall within a couple minutes of each other due to how Forensic Notes are processed. Forensic Notes are processed in three (3) distinctive steps:

Step #1 – Database Save

Forensic Note information in saved read-only into the database. The date and time associated with saving the data into the Forensic Notes application is recorded and printed within the generated PDF.

Step #2 – Digital Signature Applied

A Forensic Notes PDF is generated which includes the printed date and time from Step #1. The Forensic Note PDF is then Digitally Signed with a Digital Signing Certificate. The date and time associated with the Digital Signature is recorded within the Digital Signature. This Digital Signature’s signing date can then be displayed within the PDF as the Signing Date & Time. (see Validate via Adobe Reader / Acrobat – Step #4)

Step #3 – Timestamp Generated

A one-way HASH of the Forensic Note PDF is sent to our independent and trusted third-party Timestamping Authority (TSA) which provides a timestamp of the Forensic Note or Forensic Notebook. The date and time associated with the timestamping is recorded within the Digital Timestamp Certificate and returned to the Forensic Notes application. (see Validate via Timestamp Certificate)

 

These three (3) steps are normally processed quickly resulting in minimal differences in times associated with all three steps. However, larger documents or heavy network utilization may result in longer delays between steps causing more significant time differences. As a result, times should approximately match within a couple minutes’ difference.

Adobe Signature Panel Explained

by robAdmin

Each Forensic Note PDF has been Digitally Signed by [email protected]. As a result, any attempts to change the Forensic Notes PDF will result in a warning to the user when the Forensic Note is viewed within Adobe Reader / Acrobat as shown below.

Invalid Forensic Note – Document was changed

 

PDF: One signature invalid

PDF: Not Trusted

The above warnings indicate that the Forensic Note was modified in some way since it was originally saved and signed within the Forensic Notes application.

Valid Forensic Note

 

Digital Signature Not Trusted (Expected on 1st time viewing)

Digital Signature Not Trusted (Expected on 1st time viewing)

The certificate associated with the Digital Signature has not been trusted on the computer viewing the Forensic Note. This is expected when first viewing a Forensic Note on a computer for the first time.  For steps on how to trust the Digital Certificate associated with the Digital Signature, go to How to Trust Digital Signing Certificate.

Valid Forensic Note

Valid Forensic Note

Validate via Timestamp Certificate

by robAdmin

Forensic Notes are timestamped by DigiStamp, an independent & trusted Timestamping Authority (TSA). DigiStamps’ Timestamp Certificate (.p7s extension file) is used to verify the date and time of your Forensic Note if the validity of the Forensic Note is ever questioned.

Timestamp Validation NOT Always Required!

The instructions within this article are provided to validate a Forensic Note with the generated Timestamp Certificate. However, validation via timestamp should only occur if the validity of the Forensic Note is questioned as the steps below are more complex than using the Forensic Notes Proprietary Validation Tool.

Steps:

1. Open the Forensic Note ZIP Archive (.zip) that you downloaded from your account

 

2. Locate the Forensic Note and Timestamp Certificate

 

Forensic Notes : Archive File

 

 

3. Extract files from ZIP Archive into a regular folder

Forensic Notes : Extract files from ZIP

 

4. Go to: DigiStamp Timestamp Verification Tool

 

Forensic Notes : Digistamp Verification Tool

 

 

5. Drag & Drop the files into the DigiStamp Timestamp Verification application or press the “Choose Files” button to select your files from within File Explorer.

 

Forensic Notes : Using DigiStamp Verification Tool

 

NOTE: Your personal information is not uploaded to the DigiStamp server.

 

Forensic Notes : No Private Information Transmitted

~ Screen capture from DigiStamp site shown above (“Click to show instruction” clicked)

 

 

Verified Valid Timestamp

 

The following display confirms that the timestamp matches the Forensic Note. The date & time saved within the Timestamp Certificate is displayed within the DigiStamp confirmation application.

 

Forensic Notes : Valid

Good to Know – Filename Changes

Changing the filename of the Forensic Note or Timestamp Certificate has no effect on the validation process.

Changing a filename does not change the contents of the file or its’ HASH value. The HASH (SHA-512) value is used to validate a file with an associated timestamp.

Good to Know – UTC or GMT?

All dates & times stored or displayed are in UTC (Universal Time Coordinated).

UTC = GMT (Greenwich Mean Time

Technically, UTC is a time standard whereas GMT is time zone. Both are often used interchangeably and represent the same time offset.

Invalid Timestamp

Timestamp Certificate does not match the Forensic Note

The following shows that the Timestamp Certificate does not match the Forensic Note provided. If the filenames match but the following information is displayed, then this could be an indication that the Forensic Note has been altered in some way.

 

Forensic Notes : Invalid

Trust Digital Signing Certificate

by robAdmin

Every Forensic Note and Forensic Notebook is Digitally Signed by a Digital Signing Certificate issued by Comodo, a Certificate Authority (CA). By default, Adobe Reader / Acrobat do not have knowledge of the certificate which results in the warning “At least one signature has problems” (as shown below).

To properly validate your Forensic Notes and Forensic Notebooks, follow the steps outlined below which will add the Digital Signing Certificate to your list of Truststed Certificates. The following steps only need to be completed once on each computer viewing Forensic Notes and Notebooks.

 

Forensic Notes : Certificate not Trusted Details

NOTE: The following instructions are for Adobe Acrobat Reader CS.  Other versions of Adobe Acrobat will have similar features and options.

Step #1 – Signature Panel

 

1. Click on “Signature Panel”

 

Forensic Notes : Certificate Trusted

 

2. Click the dropdown menu next to “Validate All”

3. Click on “Validate Signature”

4. Click the “Signature Properties…” button

 

Forensic Notes : Valid Signature

 

Step #2 – Signature Properties

 

The following menu shows the properties of the Digital Signature. As shown, the Forensic Note has not been modified since it was Digitally Signed.

 

1. Click the “Show Signer’s Certificate…” button

 

Forensic Notes : Signature Properties

Step #3 – Certificate Viewer – Summary

 

The following menu shows further information related to the Digital Certificate.

1. Click the “Trust” tab

 

Forensic Notes : Certificate Viewer

 

Step #4 – Certificate Viewer – Trust

 

The following menu shows that the associated Digital Certificate is not trusted.

1. Click the “Add to Trusted Certificates…” button

 

Forensic Notes : Certificate Viewer : Trust Tab

 

Step #5 – Add Trust Settings

 

This following menu allows you to set the Trust level for the Digital Certificate associated with Forensic Notes and Notebooks. To properly validate Forensic Notes and Notebooks, you only need to ensure that the following two (2) options are selected:

1. Use this certificate as a trusted root

2. Certified documents

3. Click “Ok” to save changes

Dynamic Content, Embedded high privilege JavaScript and Privileged system operation options do NOT need to be selected. These can cause potential security concerns in some environments and are not required for validating Forensic Notes.

 

Forensic Notes : Setting Certificate Trust Settings

 

Step #6 – Validate Signature

 

Now that the Digital Certificate is trusted within Adobe Reader/Acrobat, the Forensic Note or Notebook must be re-validated as it will continue to show errors until completed.

1. Click on menu icon next to “Validate All”

2. Click on “Validate Signature”

 

The Digital Signature will be re-validated now that the Digital Certificate is trusted.

 

Forensic Notes : Revalidate Digital Certificate

 

Step #7 – Valid Signature

 

The Signature Panel should now show the following message:

“Signed and all signatures are valid”

 

Forensic Notes : Valid Signature

 

View List of Trusted Certificates – Adobe Reader

 

To view the list of Trusted Certificates within Adobe Reader, following these steps:

1. Click “Preferences…” within “Edit” menu

 

Forensic Notes : Preferences within Adobe

 

2. Click “Signatures”

3. Click “More…” button within “Identities & Trusted Certificates”

4. View list of Trusted Certificates

 

Forensic Notes : Adobe Certificate Location

Generate SHA-512 Hash

by robAdmin

Forensic Notes allows you to validate the authenticity of notes and attachments by physical file or by providing a SHA-512 Hash. To determine the SHA-512 Hash of your physical file, we suggest you download the following tool. Although it looks a bit ‘dated’, it is one of the easier to use applications for this purpose.

HashMyFiles by NirSoft
http://www.nirsoft.net/utils/hash_my_files.html

HashMyFiles - SHA-512 Hash Tool | Forensic Notes Software

Download links can be found near the bottom of the page.

HashMyFiles Download Location - SHA-512 Hash Tool | Forensic Notes Software

Digital Signature – Electronic Signature (eSignature)

by robAdmin

What is an Electronic Sigature (eSignature)?

 

Electronic signatures (eSignatures) are the equivalent of a handwritten signature in the paper world.  In simple terms, an electronic signature is simply a digital image of a signature displayed within an electronic document.

Mike Smith Electronic Signature

What is a Digital Signature?

 

Digital signatures strengthen electronic signatures by encrypting the contents of a document which allows applications to detect if the document was tampered with or altered.

Although digital signatures appear to be complicated, the knowledge required to use and validate digitally signed documents associated with Forensic Notes is minimal.

For most people using Forensic Notes, the above information is all that is needed to understand the Digital Signing process.

Forensic Notes Proprietary Validation Tool will complete the complex validation and simply display the validity of the document as either being Valid (Green) or Invalid (Red).

Click here for further information on the differences between Electronic Signatures and Digital Signatures.

 

Technical Information – Digital Signature

The digital signature relies on a digital fingerprint which is a SHA-512 Hash value. The Hash value is calculated using a one-way encryption algorithm which generates the unique value for the document.

The only way to generate a duplicate SHA-512 Hash value is if an exact duplicate file is analyzed.

The digital fingerprint is then encrypted with a Private Key through a process involving Public Key Infrastructure (PKI).

As part of the Digital Signing process utilized by Forensic Notes, an independent digital timestamp is obtained from DigiStamp, our Timstamping Authority (TSA).

DigiStamp is trusted by large banks, government agencies and global organizations.

The digital timestamp is embedded within the Digital Signature at the time of signing. This allows the person viewing the document to know the exact data and time the document was digitally signed.

The result is an electronic document that is designed to detect tampering and modifications. If any modification or tampering of the document occurs,  the signature becomes invalid and will fail to validate using Forensic Notes Proprietary Validation Tool.

In addition, the digital signature can be checked and validated within Adobe Reader or Adobe Acrobat.

 

Digital Signature – What does it mean for you?

 

From a legal perspective, this allows the creator of the Forensic Note to prove that a note or attached document existed at the date and time specified.

Not only can the owner prove that the note or attachment existed, but also that it has not been modified or altered since the signature was applied.

This is vital for admitting documents into a court room – as there may be challenges about the reliability of your documents and the time they were actually written.

 

Can you PROVE when you created a note or document?

Many people are not aware that a document can be easily manipulated to appear as if it was created days, months or even years in the past. The process can be easily accomplished by:

  1. Setting back the computers clock
  2. Creating a document
  3. Saving the document
  4. Resetting the computer clock

The result will be a document that appears to have been created in the past.  Although it may be possible for an experienced digital forensic examiner to determine the original date, the process to do so is both difficult and time consuming.

Digital Signatures and Forensic Notes Proprietary Validation Tool solves the problem of being unable to prove when a document was saved. This ensures that the author of each Forensic Note can easily PROVE when a note or document was created.

As a result, you will be able to present your notes and documents and face any scrutiny  with credibility and integrity.

About Us

by robAdmin

We get that a lot of people don’t get excited about note-taking, but for us, it has become a passion and a fundamental part of our daily lives.

Hopefully our story will inspire you to look deeper into your documentation strategies, whether it’s for your business, organization, or personal life.

Our Story

The story of Forensic Notes is born out of the frustration of trying to keep great notes in a field were note-taking is essential – Digital Forensics.

Ironically, in a field of high-technology, we were initially taking hand-written notes.

We quickly found ourselves frustrated, however, with trying to keep track of (or misplacing) notes for multiple ongoing investigations.

Not only was it hard to keep track of our notes, trying to read our own writing or recording long strings of digital data by hand was both tedious and tiresome.

It didn’t take us long to make the switch to using electronic notes using popular word processing and spreadsheet applications.

We immediately enjoyed the convenience of being able to read our own writing, spell-checking, searching key-terms, and being able to copy & paste data and images directly into our notes.

However, we started to get a nagging feeling that something was wrong with our method.

We had been trained in the strict rules of note-keeping when it came to pen & paper, which are focused on ensuring contemporaneous notes cannot be created or altered after the fact.  But to our surprise, there were no real rules or Standard Operating Procedures (SOPs) for keeping digital notes.

And because we were working in the field of digital forensics, we realized how easy it would be to alter these key electronic documents with no easy or reliable method to identify or track such changes.

Then we started to get worried.

If our electronic notes were not accepted in court, then obviously all our hard work was for nothing.

After searching for an acceptable solution and finding none, we asked…

What if we could build an electronic note-taking application that followed and mimicked the strict rules of the pen and paper?

And this was the birth of Forensic Notes.

Our initial goal was simple, replicate the benefits of a physical notebook while allowing access to the technological conveniences available in a digital format.

We already achieved our initial goal and many more.

But our story is far from over!

We are still making notes, and looking for ways to make the process easier, faster, and more accessible for the various ways other people want to make their notes.

And that’s Forensics Notes in a nutshell.

Want to know more about the product and the people who make up the Forensic Notes Team?

Read below.

Meet the Team

Robert Merriott
Founder & CEO.

Robert Merriott has been a municipal police officer for over 14 years working as a frontline police officer, tactical operator, and most recently as a detective in the Technological Crime Unit specializing in Digital Forensics and Cybercrime.

Prior to his policing career, Robert obtained a Bachelor of Science in Computer Information Systems and worked in the private sector as a web application developer. While working as a developer, Robert was awarded Microsoft MVP status and was a founding board member of the ASPInsiders, an organization that worked closely with Microsoft to provide expert feedback on the development of the ASP.NET web application framework.

As a result of his policing and private sector work experience, Robert understands the threats and liabilities faced by organizations with an online presence as well as the challenges faced by police agencies in investigating and preventing crimes.

[email protected]

Mike Post
Co-Founder &
Manager of Training

Mike Post began his education in Computer Technology, but ended with a degree in Behavioral Science.  After graduation he began his career working in education overseas.

After returning home, Mike moved his skills into Law Enforcement where over the past 11 years he has worked as a frontline police officer, an Open-Source Intelligence (OSINT) investigator, and then as a Digital Forensic Examiner.

Mike has earned several certifications in the Digital Forensics field.

[email protected]

John Pyper
Co-Founder &
Manager of Customer Success

John Pyper has a degree in Applied Science and worked as an Engineer for 9 years before moving his skills to Law Enforcement in 2001.   As a police officer, John has worked over 10 years as a detective in the fields of Digital Forensics and Cybercrime.

John has worked on hundreds of investigations and examined over a thousand exhibits.  John has presented evidence at various levels of the justice system including Supreme Court where he has been qualified as an expert in the field of digital forensics.

[email protected]

Kimberly Owen
Customer Success Representative

Kimberly Owen is a caring professional dedicated to helping Forensic Notes clients succeed.

Prior to joining Forensic Notes, Kimberly worked within the airline industry as an inflight manager travelling around the globe. Recently, she took time off to start a family which has resulted in four wonderful children.

Kimberly excels in 1-on-1 interactions with clients due to her sincerity and sarcastic demeanor.

[email protected]

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Accept Read More