The case folder
A lab and an authorized investigation both end with files. Keep the original, a working copy, a hash, and the time you received it. Keep your notes beside that folder, not inside it.
The original and a working copy
Leave the file you were given untouched. Copy it, and do the reading on the copy. If a tool has to open something, it opens the copy. The original is what you can check again later.
Name the copy so a second person can see which one it is. “Disk” and “disk (2)” are not names. “image-original” and “image-working” are enough.
The hash
Record a hash of the original when you receive it, and write which algorithm you used. A later hash of that same file should match. If it does not, you no longer have the file you were given.
The hash names the bytes. It is not a finding, and it does not say what is inside. It only says this file is still that file.
The time you received it
Write when the file arrived, and the zone you were told. The clocks inside a disk image or a log are a different time. Do not replace one with the other. Both belong in the note, labeled.
The timeline lab is the practice for several clocks that do not agree. Put them in order there. Do not invent a single time by averaging.
What does not go in the same folder
Do not drop your notes into the evidence directory. Do not put a tool, an installer, or the output of a program you ran against the original in that folder. Notes sit next to the case, with a pointer to the hash and the time.
The findings page is the note: what failed, who can reach it, and what you would change. The forensics workbench is how to read a disk or a memory image you were allowed to hold. The first hour of a ransom note is the decision not to clear the machine that still has those files.