What belongs in examiner notes so a second examiner could reproduce your work on a backdoored installer?
answer
- could a stranger repeat this exactly?
- which copy, which tool version
- the literal search term, not 'searched'
- null results are findings too
- dead ends stay in; nothing is pruned
basics
~20 sNotes must name which copy you worked on, the tool and version, the exact steps and search terms, the time of each step, and every result including the ones that found nothing. Write them as you go, and keep observations separate from conclusions.
solid answer
~50 sThe test is reproducibility: hand your notes to a second examiner with the same material and they should reach the same observations without asking you anything. So each entry records the working copy or item id you acted on, the tool and its version, the precise action — the search term, the path, the parameter, not "searched for indicators" — the timestamp and timezone, and the result, including null results. Negative findings matter: "no scheduled task referencing the installer path on this image" is a finding a second examiner must be able to re-run. Record deviations from your standard procedure and why. Notes are contemporaneous and append-only in effect: strike and date corrections, never erase, and never delete a dead end because it turned out to be uninteresting. Keep what you saw and what you think it means visibly distinct, so a later reader can adopt your observations without inheriting your interpretation.
go deeper
Know that notes are written while you work, name the copy and tool you used, and keep null results. Be able to say why a note reading 'searched, nothing found' is not usable.
Explain the reproducibility standard mechanically: item and copy identifiers, tool versions, literal steps, timestamps, null results, and struck-not-erased corrections.
Demonstrate the judgment of keeping observation separate from interpretation, disclosing deviations from procedure at the time, and producing notes a receiving examiner at another firm can act on unaided.
Own how note discipline survives real time pressure — what the minimum viable standard is mid-incident, and how you get a team to keep it when nobody is watching.
## The standard: a second examiner, no conversation The working definition of adequate examiner notes is behavioural, not stylistic: give the notes and the same material to a competent second examiner, and they should be able to repeat what you did and arrive at the same observations without asking you a single question. Everything else in this section follows from that test. This matters concretely in a supply-chain case. The malicious vendor installer, the image of the infected host and your notes are all going out of the building — to an external IR firm's examiner, and later to counsel. The receiving examiner does not know your habits, your naming conventions or which of the three copies of the installer you actually opened. Anything that lives only in your head does not travel. ## What each note entry carries - **Which item, which copy.** Not "the installer" but "working copy WC-04b of item EV-04". If a case has an original, a working duplicate and a copy sent to the vendor, an unqualified reference is ambiguous, and ambiguity about which copy produced a finding is the kind of thing that ends the usefulness of the finding. - **The tool and its version.** Tools change behaviour between releases. "Parsed the prefetch directory" is not reproducible; the tool name and version is. - **The exact action.** The literal search term, path, filter, time range or command intent — enough that the step can be re-executed. "Searched for indicators" is a note about having been busy. - **When.** Date, time and timezone of the step, not just of the session. - **The result, including nulls.** "No autorun key referencing that path" is as much a finding as a hit, and it is one that has to be re-runnable — a null result nobody can reproduce is not a finding at all, it is an assertion. - **Deviations.** If you departed from the standard procedure — worked on the original because a duplicate would not mount, skipped a step for time — record it and record why, at the time. A disclosed deviation is a limitation; a discovered one is a credibility problem. ## Contemporaneous and append-only Write as you work. Notes composed at the end of a long day are a recollection of a day, and they will silently omit the dead ends, which is exactly the material a second examiner needs in order to avoid repeating them. Corrections are struck through so they remain legible, dated and initialled, with the correction added as a new line. Erasing, retyping or "cleaning up" notes destroys the property that makes them worth anything. The same rule applies to unattractive content. The search that found nothing, the hypothesis that turned out to be wrong, the two hours spent on a file that was benign — all stay. A note set with no dead ends in it is not a record of an examination; it is a summary written afterwards. ## Observations and conclusions stay visibly separate A note that says "the installer established persistence" has folded an observation into a conclusion. What was observed was a specific artefact on a specific copy at a specific time; "established persistence" is the interpretation. Keeping the two typographically or structurally distinct means a later reader — the receiving examiner, counsel, or you in six months — can take your observations and test your interpretation against them, which is the entire point of letting someone else read your work. ## Common failure modes - **Conclusions without steps.** The note records what you decided, not what produced it. Nobody can reproduce a decision. - **The tool's audit trail treated as notes.** A forensic suite or case system may log actions, but it does not record why you did them, what you ruled out, or the reasoning that shaped the next step. It is evidence about the tool, not a substitute for an examiner's notes. - **Pruning.** Deleting the dead ends before handing the file over. It always reads as curation. - **Shared identity.** Notes signed by "the SOC" or written under a shared account. Notes are attributable to a person, because the person is the one who will be asked about them. ## Why this is worth the friction mid-incident During a live intrusion, taking notes at this granularity feels like overhead against the clock. Two things pay it back. First, it is the only mechanism that lets work be handed over — to the outside firm, to the next shift, to a specialist — without the receiving examiner having to redo everything from scratch to trust it. Second, the questions that determine what you can ultimately assert about the intrusion arrive weeks after the adrenaline has gone, at which point the notes are the entire memory of the case.
- A note reads 'ran a keyword search across the image, nothing relevant'. Why is that inadequate?It names neither the copy searched, the terms used, the tool and version, nor the scope of the search, so nobody can re-run it. A null result that cannot be reproduced is an assertion, not a finding — and negative findings often carry real weight in a case, so they need the same rigour as hits.
- Your forensic tool keeps its own audit log of every action. Does that replace examiner notes?No. The tool records what was executed; it does not record why, what you were testing, what you ruled out, or the reasoning that led to the next step. It also covers only work done inside that tool. Treat it as corroboration for the steps it does capture, not as the note set.
- You spent two hours on a file that turned out to be benign. Do those notes go in the file you hand over?Yes. Dead ends tell the receiving examiner what has already been eliminated and stop them repeating it, and a note set containing only successful lines of inquiry reads as edited. Record what you looked at, what you found, and the basis on which you set it aside.
saying these in an interview costs you the question
- Writes notes up from memory at the end of the day
- Records conclusions but not the steps that produced them
- Omits the tool version and which copy was examined
- Deletes notes about dead ends before handover
- Says the tool's audit trail is the note record
- Notes attributed to a team or shared account, not a person