It sounds like you are on the right track. Depending on where you work, you should include the contact person for the case along with their contact information, the search warrant/court order number that authorized the analysis, and a space for the software and the version of the software you are using. For example, Cellebrite Physical Analyzer 7.xxxx and so on.
If there was a keyword list provided by the contact person or created by you or another examiner, I would have a space to document that, where it could be found, and if the search for those terms was completed. You will want a space to document if a report or other deliverable was created, to whom it was sent, and the way it was delivered (in person, shipped with tracking number, etc). If you have a property sheet that already documents such things, it will be up to you if you want this type of redundancy.
For those entries involving dates (for example when a keyword search was done, when the examination started, when the deliverable was sent out, evidence received/returned) leave a space so the date can be written out and not just a check box indicating it was done.
I do not have a copy of the form I created, but there were many times most of my case notes were on the sheet. It also shows a workflow documenting what has been done. In case, for some reason you are not available to complete the analysis (sickness, transfer, vacation, etc) or if someone needs an update on your analysis, all that needs to be done is someone to review your sheet and they can give the update or resume the analysis without duplicating steps.
Feel free to reach out to me if you want any further ideas or feedback on the spreadsheet you are working on.
↧