DFIR Client Interviews

Below are recent interviews with clients that work in Digital Forensics and Incident Response (DFIR).

August 2018 – Digital Forensics Examiner – USA Private Industry

I recently had the opportunity to talk with “Tom” about his experiences in using Forensic Notes. Tom has been a client for over a year and had the following to say…

 I haven’t been using it as much as I’d like.  The “online” part of it makes it limiting in some cases.  For example, I can’t use it on my forensic laptop at work because I don’t keep that connected to the Internet. But I’m sure I’m not the first person to say that.

I do use it for some personal things that I do so I can keep track of my notes.

The requirement to be ‘online’ is a common issue for those that work in an environment where the internet is restricted or not available. As a result, we have been working hard to develop our 2^nd generation On-Premises software solution to solve this issue.

On-Premises does not require an active internet connection.

However, for most of our users, they find the ability to move locations and keep their notes available to be the ideal solution.

 … my frustration is really finding a good note taking application that I can use cross-platform, and has some security behind it [like Forensic Notes].

I’ve used [other note taking application] in the past, and I’ve liked it, but it’s too unstable.  I was using it recently at work and the program crashed and lost all of the notes I had put in up until that point.

I’ve been using OneNote at work, but it’s just terrible at that sort of thing.  I know others have used Word, Notepad, etc but I still have concerns about those products. 

Since Forensic Notes can be run in any web browser, it is Cross-Platform available on Windows, Macintosh, Unix and Mobile devices.

 I like the way Forensic Notes is laid out, but again the only reason why I can’t use it more is because it has to have the Internet connection. 

July 2018 – Digital Forensics Examiner – Canadian Police Officer

I asked the following questions:

1) Would you be able to advise what you like and don’t like about Forensic Notes?

2) What features do you use most often?

• Do you embed images within your notes?
• Take pictures/video during warrants?
• Add attachments (warrants, files)?

The Responses Follow:

Would you be able to advise what you like and don’t like about Forensic Notes?

There are two features that I really enjoy:

1. The ability to access it from anywhere; multiple offices, computers and iPad.
   Knowing that I can start a case at the office for a search warrant and then access the notes on scene with my iPad.
2. The other feature that I quite enjoy now is that you can now create a folder.
   This I love! as I have a basic template for each case now;

   1st folder – Case Assignment/Coms with PI (Request, search warrants, any emails, etc. …)
   2nd folder – Exhibits
   3rd folder – Examination
   4th folder – Disclosed material

What features do you use most often?

As above:

• The folder option and attaching images (search warrants and usually the first overall image of an exhibit).

I haven’t used the sticky note or the note function yet as I was actually worried they would become a permanent record.

Do you embed images within your notes?

Yes, I do.

Usually the search warrant and I have now started attaching the first overall image of an exhibit to its note page in the Exhibit Folder.

Take pictures/video during warrants?

I only take pictures of the actual exhibits I touch/image. The overalls are done by the IDENT folks.

Add attachments (warrants, files)?

Only exhibit pictures, warrants, and the text page the members complete requesting our service and what it is they would like us to find.

Since we only have [reporting system] and we don’t have an actual case management tool/software in our office I have been trying to lay my notes out like a poor man’s case management tool and record keeping.

Do you have any suggestions for improving Forensic Notes?

I would suggest maybe a template/note for showing chain of custody maybe? … I find that the features and the functionality you have rolled out really good and super easy to use.