Why You Should Never Use Word or OneNote for Investigation Notes
Microsoft Word and OneNote are excellent productivity tools. But there is one critical task for which they were never designed and should never be used: creating contemporaneous notes during investigations.
This is not a matter of opinion. It is a matter of evidence law, forensic science standards, and the hard lessons of wrongful convictions.
Timestamps Can Be Easily Falsified
The entire evidentiary value of a contemporaneous note depends on proving when it was created. Word and OneNote both fail this fundamental test.
Microsoft Word
Word relies entirely on the Windows system clock for its internal timestamps. Change the system date before creating or saving a document, and Word records the false date as real. There is no independent verification, no server-side timestamp, and no cryptographic proof of when the document was actually created.
As Meridian Discovery's forensic analysis demonstrated, the FILETIME values embedded in Word's metadata can be manipulated using a hex editor or by simply changing the system clock, and mainstream forensic tools may not even detect the discrepancy.
Microsoft OneNote
OneNote is even worse. Microsoft's own support documentation openly instructs users on how to change the creation date and time of any page.
"You can change the original creation date and time of any page in your notebook. Near the top of the page, just underneath the page title, click the date." Microsoft Support
This is not a hack or a workaround. It is a built-in feature. For personal notes, this is fine. For investigative evidence, it is fatal.
Content Can Be Modified Without Any Trace
A contemporaneous note must be immutable. Once recorded, it cannot be altered without detection. Neither Word nor OneNote provides immutability.
Microsoft Word
- Track Changes is optional. If it wasn't enabled when the note was first created, there is no record of any edits.
- Track Changes can be turned off at any time. An investigator could turn it off, make changes, then turn it back on with no record of the untracked edits.
- All tracked changes can be permanently removed. "Accept All Changes and Stop Tracking" destroys the change history permanently.
- The Document Inspector removes all traces. Comments, revisions, versions, and annotations can be stripped in a single click.
Microsoft OneNote
- Has no equivalent of Track Changes. Every edit is silently absorbed into the page content.
- Page version history exists only when syncing through OneDrive or SharePoint, and even then it can be purged.
- There is no mechanism to prove that the current content is the same as what was originally written.
- There is no audit trail whatsoever. No log of who accessed the note, when, or what they changed.
No Digital Signatures or Cryptographic Proof
In courtrooms across Canada, the United States, the United Kingdom, and Australia, the authenticity and integrity of evidence is paramount. Digital signatures provide cryptographic proof that:
The document existed at a specific date and time, timestamped by an independent authority
The content has not been altered since it was signed (any modification breaks the hash)
The identity of the author is verified through the certificate chain
Neither Word nor OneNote provides any of this. Without cryptographic proof, the only way to verify a document's authenticity is to hire a digital forensic examiner.
An independent forensic examiner costs $150 to $350 per hour, with most examinations taking a minimum of 40 hours. That's potentially $10,000+ per document, with no guarantee of a definitive answer.
Courts Already Distrust Unverifiable Digital Evidence
The legal landscape has shifted decisively toward demanding provable integrity for digital evidence. Courts across multiple jurisdictions have established that unsupported testimony about digital records is insufficient.
🇨🇦 Canada
In Wood v. Schaeffer [2013] SCC 71, the Supreme Court of Canada established that investigators have a duty to prepare "accurate, detailed, and comprehensive notes as soon as practicable."
"Reliable independent and contemporaneous police officer notes are central to the integrity of the administration of criminal justice." Schaeffer v. Wood [2011] ONCA 716
🇺🇸 United States
The Federal Rules of Evidence recognize contemporaneous records through Rule 803(1) (Present Sense Impression) and Rule 803(5) (Recorded Recollection), both of which depend on establishing that the record was made "while or immediately after" the event.
If the timestamp cannot be independently verified, the foundation for admissibility collapses.
🇬🇧 United Kingdom
In R. v. Smith [2011] EWCA Crim 1296, the Court of Appeal criticized forensic examiners for failing to make contemporaneous notes.
"No competent forensic scientist would conduct an examination without keeping detailed notes of his examination and the reasons for his conclusions." R. v. Smith [2011]
🇦🇺 Australia
In Graham v The Queen [1998] HCA 61, the High Court held that "fresh in the memory" means "recent" and is typically measured in hours and days. Unverifiable Word documents do not carry the same evidentiary weight.
Wrongful Convictions Have Already Been Caused by Poor Note-Taking
This is not a theoretical risk. Real people have been wrongfully convicted and spent years in prison because investigators failed to maintain proper contemporaneous notes.
Gregory Parsons
Wrongful Murder Conviction, CanadaThe Lamer Commission of Inquiry (2006) found that officers failed to take proper notes, using scraps of paper and failing to record critical information. Parsons was wrongfully convicted of murdering his own mother.
Guy Paul Morin
Wrongful Murder Conviction, CanadaThe Kaufman Commission (1998) investigated the wrongful conviction and issued 119 recommendations, including Recommendation 100 specifically addressing note retention policies.
James Driskell
13+ Years Wrongfully Incarcerated, CanadaThe Driskell Inquiry (2007) resulted in specific recommendations on police note-taking practices after Driskell spent over thirteen years in prison for a crime he did not commit.
In every one of these cases, better note-taking practices could have prevented the injustice.
Memory Science Demands Provable Contemporaneity
Hermann Ebbinghaus's Forgetting Curve, first established in 1885 and replicated in a 2015 PLOS ONE study, demonstrates that humans lose approximately 50% of newly learned information within one hour, with the majority of forgetting occurring within the first 24 hours.
"The best approach for a Judge to adopt in the trial of a commercial case is, in my view, to place little if any reliance at all on witnesses' recollections of what was said in meetings and conversations, and to base factual findings on inferences drawn from the documentary evidence and known or probable facts." Mr Justice Leggatt (now Lord Leggatt, UK Supreme Court), Gestmin SGPS SA v Credit Suisse [2013]
The clear implication: documentary evidence must be trustworthy. A Word document or OneNote page whose date, time, and content cannot be independently verified is no more reliable than the memory it was supposed to replace.
They Create a Cross-Examination Trap
Perhaps the most practical reason to avoid Word and OneNote is what happens when an investigator takes the stand. Defense counsel is trained to attack note credibility, and these tools provide a roadmap for destruction.
The questions that will be asked:
- "Officer, you created these notes in Microsoft Word, correct? And Word allows you to edit a document at any time without leaving a trace, doesn't it?"
- "You're aware that Word's Track Changes feature is optional and can be turned on and off at will?"
- "And you're aware that all tracked changes can be permanently deleted with a single click of 'Accept All Changes'?"
- "Word relies on the computer's system clock for its timestamps, correct? And the system clock can be changed to any date by the user?"
- "So you cannot prove, with any independent, verifiable evidence, that these notes were written when you claim they were written, can you?"
- "And you cannot prove that these notes haven't been altered since you say you first wrote them, can you?"
For OneNote, the cross-examination is even more devastating:
- "Microsoft's own documentation says you can change the creation date of any page. Did you know that when you chose to use OneNote for your investigation notes?"
Any investigator who answers these questions honestly must concede that their notes cannot be independently verified. That concession alone can be enough to create reasonable doubt.
How Do Your Tools Measure Up?
| Requirement | MS Word | OneNote | Forensic Notes |
|---|---|---|---|
| Timestamps cannot be altered | User can change system clock | Built-in date/time editing | Independent cryptographic timestamp |
| Content is immutable once saved | Unlimited edits, no lock | Continuous editing, no lock | Digitally signed and locked |
| Complete audit trail | Track Changes is optional and removable | No audit trail | Automatic, immutable audit log |
| Tamper detection | No tamper detection | No tamper detection | Cryptographic verification |
| Provable authenticity | Metadata easily manipulated | No authentication mechanism | Digital certificate chain |
| Independent verification | Requires $10,000+ forensic exam | Requires $10,000+ forensic exam | Instant online verification |
"Contemporaneous Notes are unavoidable, thus inescapable, when it comes to examining evidence and are akin to the standard of Ethics."Greg Smith, Principal Consulting Forensic Engineer, Institute for Digital Forensics (IDF)
"You may never need to defend your DFIR investigation in court, but you should complete every case as if you would be testifying as an expert in Supreme Court."Harlan Carvey, Author of Windows Registry Forensics and Windows Forensic Analysis Toolkit
Your Evidence Deserves Better Than a Word Processor
Forensic Notes provides digitally signed, independently timestamped, and instantly verifiable contemporaneous notes. Start your free trial and see the difference.
Free 7-day trial · No credit card required · 57-day money-back guarantee