As I started my career in digital forensics, an early lesson from my mentor (a former police officer) was the importance of meticulous note taking. He emphasised that a judge once said during cross-examination, "if you didn't write it down, it never happened." 

Maintaining contemporaneous notes is essential, as they document actions and provide explanations for decisions made during forensic examinations. Having testified as an expert witness, I can attest that without these contemporaneous notes, recalling decisions made months or years ago would be just about impossible.  

Pre-pandemic, our work dynamics were different, with remote/ hybrid setups relatively uncommon. Lockdown forced a radical shift in communicating, as face-to-face discussions moved from the office to phone and chat applications, such as WhatsApp, Teams, and Slack. This provided a windfall of digital records which surpass its predecessor of mere hearsay, which can be inconsistent between parties and carries much less weight as evidence.

During investigations, compiling diverse evidence sources is vital to construct a comprehensive timeline of events. Observing the ongoing COVID inquiry, it is evident that WhatsApp messages are playing a pivotal role in scrutinising the decision-making of politicians and civil servants.  So, what have these messages revealed that emails have not? The answer is context, these records offer contemporaneous insights into decision-making processes, the exchange of advice, and even the workplace culture. The unfiltered nature of the content and language used provides a unique perspective.  As shown in this case when used in conjunction with emails and documents it paints a clearer picture into understanding what has happened.

In the context of an investigation, I believe that these chats are a form of forensic note taking as they provide chronological digital records behind decision making.  They give clarity to actions that otherwise could have been remembered incorrectly, forgotten altogether or fabricated between parties.

Chat data is the new younger sibling sitting at the table of eDiscovery, more laid back with less concern for the rules than any of its big brothers or sisters, and it is desperate for your attention. My question is, can you afford to keep on ignoring it?