01Purpose and scope

To make the examination itself examinable: the notes are the record from which the report is written and against which the report is checked.

Every examination of every item, from the first mount of a working copy to the last query before the report.

02Prerequisites

A note format with fixed fields: time (UTC), item, action, tool and version, parameters, observation, decision.
A convention for referencing evidence: item number, file path, offset or table and row, hash.
Notes stored where they cannot be edited without trace (append-only log, signed PDF per session, or version-controlled file).

Open a session
Record date, start time (UTC), examiner, case and item numbers, the working copy used and its hash as verified at the start of the session, workstation identifier and the questions being addressed.
RecordSession header.
Note each action as it happens
Tool, version, exact command or settings, input, output location and hash of any produced file. Write the observation before interpreting it. Mark interpretations as such.
RecordOne line per action.
Record negative results and dead ends
What was searched and not found, which hypotheses were tested and rejected. These lines are what allow the report to say 'no evidence of' honestly.
RecordNegative-result lines.
Reference evidence precisely
For each observation that may appear in the report: item number, path, offset or table/row, raw value, decoded value, decoding method.
RecordReference fields filled.
Record decisions and their reasons
Why a tool was chosen, why a path was not pursued, why a result was treated as unreliable. Decisions made with the requester are recorded with time and name.
RecordDecision lines.
Close the session
End time, a two-line summary of what was established and what remains, the state of the working copy, and the custody line for returning the item to storage.
RecordSession footer; custody line.

Notes written at the end of the day from memory are not contemporaneous and will not survive cross-examination.
Recording the conclusion without the raw value and its location makes the finding unverifiable.
Mixing observation and interpretation in one sentence hides which part is evidence.
A tool's default export omits parameters; record them yourself.