5 free or cheap tools to manage investigations

Free software once used only by the CIA. A pen that will change your life. Brandon Gregg shares these and other inexpensive ways to manage corporate investigations.

As you already know or you will learn your first time in court, proper documentation of your investigation is a must for all your cases. Unfortunately your case plan, notes, evidence and even how you come to the conclusion of your investigation can be more complex and harder to manage then the case itself.

From sticky notes and pages of documents, to digital screen shots and chain of custody forms, your investigative folder can quickly pile high or worse get damaged or lost. In conjunction with my past articles on free and cheap investigation resources, here are five tools to take your investigation building to the next level.

Case Plans

Often investigators hit the ground running at the start of their case and skip building the proper foundation of an investigation: the case plan. Although experienced investigators can investigate forwards and backwards, having a case plan for your client, management and own organization will help outline your investigation, streamline tasks even before they start and keep you on track no matter what interruptions may occur.

Also see 'How to plan an investigation'

Personally I am a fan of Microsoft Project, but since this is cheap and free tools, you can also download Open Workbench (www.openworkbench.org) a worthwhile open source competitor to Project that can handle all of your complex case management needs. Before your next big investigation take Open Workbench for a test drive and setup a basic investigative case plan template. Make note of generic to-do lists to have ready to use, alter and follow during your next case. Easily add project deadlines and estimate due dates for your clients and team, as well as lay out the direction and closure of your case. As the steps are completed visibly check them off like a to-do list and quickly flow through your investigation. If you work multiple cases or have interruptions this will also help you keep on track.

Digital Notepads

Once you are off running with your case plan, you can never write too many notes detailing your interviews, evidence collection and steps you took to solve your investigation. Today people carry smart phones, laptops and even iPads for note taking, but I prefer the standard pen with a technological twist. From SolidTek's DigiMemo collection to Dane-Elec's Z-PEN Wireless USB Digital Pen, both these digital devices transfer your written notes into images and text on your computer to easily add to your digital case file. Although transferring your written notes to text on your computer won't make you a better note-taker, it will save everything you do and can be searchable online.

Case Notes

Organizing any investigation is no easy task. With your case plan setup and digital notes ready to be stored, your honesty can still be called into question in court. Defense attorneys can inquire about your disposition of notes, your collection of evidence and the steps you took in your investigation. To help combat any questions of integrity and to keep your own case organized much like the case plan, Quantus-Conspicio-Communio Information Security (QQCIS) offers a freeware program called CaseNotes (www.qccis.com/forensic-tools) to track all your case steps in a tamper proof audit trail. Although a simplistic program, CasesNotes easy to use notepad like setup can work with your digital pen and Open Workbench to keep track of all the actual steps, interviews and evidence your investigation collected. Cases can also be encrypted for safe storage and there is actually a digital hash fingerprint for each note entry. Simply paste in your findings after each task from the case plan and watch your case notes stay organized, searchable and free from any defense attorney's questioning.

Evidence Management

As your notes digitally build up in a clean, searchable database, your physical evidence can get lost behind. Maintaining good chain of custody and storing your evidence is just the beginning to proper case management. Utilizing a low price Dymo label printer like the LabelWriter 450 can take your physical evidence (and case folder) management to the next level. Dymo's software is straightforward and quickly allows you to create easy to read labels with "Confidential" warnings, current dates, random tracking ID #s, barcodes and company logos to mark and uniquely track your evidence.

Hypothesizing Your Investigation

ACH has become a staple in the intelligence analyst world to take collected data, rumors and other pieces of evidence, big or small and compile them into a system that weeds out biases like social influence and our own mind's information processing shortcuts to prove and disprove theories. When I recently read on Wired.com that software developer and former Defense Intelligence Agency analyst Matthew Burton was releasing an open source version of ACH, I quickly contacted him to get a sneak peak. Signing up for a free membership at beta.competinghypotheses.com, you can start to build on your own investigations with your team and others.

Take Burton's example of identifying those responsible for a recent bombing. Quickly share and compare information about the types of evidence, method of operation and timing of the bombing to weed out your hypothesis about who is responsible and watch the facts speak for themselves. Although this tool is not needed in all investigations, it certainly can help get through dead ends and office politics.

The above tips are only a few small ways of tracking investigations and building cases. I look forward to you sharing your own personal tips in the comments below.

Brandon Gregg, CPP, is a corporate investigations manager. His website is www.BrandonGregg.com.

Copyright © 2010 IDG Communications, Inc.

7 hot cybersecurity trends (and 2 going cold)