> For the complete documentation index, see [llms.txt](https://docs.monolithforensics.com/monolith/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.monolithforensics.com/monolith/using-monolith/case-management/cases/notes.md). # Notes Document findings, observations, screenshots, and other Case context using searchable, versioned Notes that can be exported or incorporated into Case reports. Notes provide a flexible workspace for documenting findings, observations, screenshots, methodology, investigative context, and other information collected throughout Casework. Rather than keeping examination notes in a separate application, users can document work directly within the Case where it remains connected to the Evidence, Tasks, and other records being worked. Notes are automatically saved, searchable, versioned, and available for export. They can also be incorporated into Monolith Case Reports, allowing documentation created during the examination to become part of the final work product without needing to recreate it later. ### Why Use Notes? Notes can serve as the working narrative of a Case. Use Notes to capture information such as: * Examination findings * Investigative observations * Screenshots and images * Procedures or methodology * Important dates and timestamps * Commands, queries, or technical details * Conversations or contextual information * Evidence-specific findings * Task-related work * Information that may later be included in a report Because Notes live directly within Monolith, they can become part of the Case record rather than remaining in a separate notebook, document, or note-taking application. As work progresses, individual Notes can be exported independently or selected for inclusion in a larger Case Report. ### Video Walkthrough {% embed url="" %} If the video does not render, [you can watch o nYouTube here](https://www.youtube.com/watch?v=TD_W1tH7_Jo) {% endembed %} ### View Notes Open a Case and select the **Notes** tab to review Notes associated with that Case. The Notes workspace brings together Notes created throughout the Case, including Notes associated with different parts of Monolith. Depending on the Case, this may include: * **Case Notes** * **Evidence Notes** * **Task Notes** * Other supported Notes associated with Case activity This allows users to document information where the work is happening while still reviewing those Notes together from the Case Notes workspace. Notes are grouped by their associated record, making it easier to distinguish general Case documentation from Notes related to specific Evidence Items or other work. ### Create a Case Note Create a Case Note when the information applies broadly to the Case rather than to a specific Evidence Item or Task. Case Notes can be used as a general workspace for documenting Case activity, findings, research, observations, or other information that should remain part of the overall Case record. Each Note has a name that can be changed as the purpose of the Note becomes clearer. Notes are automatically saved while you work. {% hint style="info" %} Notes do not require a separate manual Save action. Changes are automatically saved and become part of the Note's version history. {% endhint %} ### Take Notes Where You Work Notes do not need to be created only from the Case Notes tab. Users can also begin documenting work from other areas of the Case. For example: * Create an **Evidence Note** while reviewing or examining an Evidence Item. * Create a **Task Note** while documenting work performed for a Task. * Create a **Case Note** for information that applies to the Case more broadly. These Notes remain associated with the record where they were created while also being available from the Case's overall Notes workspace. This allows users to document findings in context without losing the ability to review the Case documentation as a whole. ### Using the Note Editor The Note editor provides rich formatting tools for creating structured examination documentation directly within Monolith. Users can add and format content such as: * Headings * Paragraph text * Bulleted lists * Numbered lists * Bold, italic, underline, and other text formatting * Blockquotes * Links * Inline code * Horizontal dividers * Images and screenshots * Dates and timestamps This makes Notes useful for both quick observations and detailed technical documentation. The editor also supports undo and redo while editing. ### Slash Commands Type `/` in the Note editor to quickly insert common content and formatting without leaving the keyboard. Available commands include: * **Text** * **Heading 1** * **Heading 2** * **Heading 3** * **Heading 4** * **Bullet List** * **Numbered List** * **Code** * **Blockquote** * **Horizontal Rule** * **Current Date** * **Current Timestamp** * **Image** Slash commands provide a quick way to structure documentation while an examination is in progress. For example, **Current Timestamp** can be useful when recording when an action was performed, while **Image** can be used to add supporting screenshots directly alongside the written findings. ### Images and Screenshots Images and screenshots can be inserted directly into Notes, including by copying an image to your clipboard and pasting it into the Note editor. This makes it easy to document work as it happens. For example, while examining data in a forensic tool, you can use your operating system's built-in screenshot or snipping utility to capture a relevant result, copy it to the clipboard, and paste it directly alongside your written findings in Monolith. This can be useful for capturing: * Forensic tool output * Artifact views and examination results * Search or query results * Application or system screens * Error messages * Configuration information * Relevant visual findings * Other supporting context Screenshots can be placed directly alongside explanatory text, headings, timestamps, and other Note content so the visual evidence remains connected to the context describing why it was important. Images and screenshots remain part of the Note and are included when supported Notes are exported to PDF or Microsoft Word or incorporated into Case Reports. {% hint style="info" %} Clipboard paste can make Notes especially useful during active examination. Capture the relevant portion of your screen with your preferred screenshot or snipping tool, copy it, and paste it directly into the Note without needing to save and upload the image separately. {% endhint %} ### Find and Organize Notes The Notes workspace provides several ways to locate documentation as the number of Notes in a Case grows. Users can: * Search Notes * Filter Notes by user * Review Notes by associated record type * Expand or collapse groups of related Notes * Sort Notes by name * Sort by Created On * Sort by Updated On * Open multiple Notes in tabs Available sort options include: * Note Name (A-Z) * Note Name (Z-A) * Updated On (Newest) * Updated On (Oldest) * Created On (Newest) * Created On (Oldest) This allows a Case to accumulate substantial documentation while keeping individual Notes easy to locate later. ### Notes From Other Users Notes can support collaborative Casework. Users can switch between their own Notes and Notes created by other authorized users. When a colleague's Note is available to the current user, it is presented as read-only rather than allowing one user to silently modify another user's documentation. Visibility also follows the permissions and organization of the underlying Case and Note location. This allows teams to share examination documentation while preserving the relationship between a Note and the user who created it. ### Note History and Versioning Monolith automatically maintains version history as Notes are edited. Open the Note menu and select **History** to review previous versions. Version History records earlier states of the Note along with information about when the version was created and the user associated with the change. Previous versions can be reviewed and restored when needed. {% hint style="info" %} Version History allows the current Note to evolve during Casework while retaining previous versions for future review. {% endhint %} This can be particularly useful when Notes contain important examination findings or documentation that changes as additional information becomes available. {% embed url="" %} How To Video on Notes Version History {% endembed %} ### Rename or Delete a Note Use the Note options menu to manage an existing Note. Available actions include: * **History** * **Rename** * **Delete** Rename a Note when a more descriptive title would make it easier to locate later. Delete Notes only when the information is no longer required as part of the Case documentation. ### Export Notes Notes can be exported directly without creating a complete Case Report. Supported export formats include: * **PDF** * **Microsoft Word** Users can export an individual Note, multiple open Notes, or available groups of their Notes depending on the selected export option. Formatting, images, and other supported Note content are carried into the generated document. #### Exported Notes and Case Files When a Note export is generated, Monolith also adds the resulting PDF or Microsoft Word document to the Case **Files** area. This provides a convenient way to preserve the generated document alongside other Case files and work products. Exporting Notes can be useful when: * A finding needs to be shared independently * Only a portion of the Case documentation is needed * A standalone examination note is required * Notes need to be preserved as a separate document * A user wants to review documentation outside Monolith ### Include Notes in Case Reports Notes can also become part of a larger Monolith Case Report. When configuring a standard Case Report, users can select the Notes that should be included in the report and control their order. This allows documentation created throughout the examination to become part of the final report without requiring the examiner to rewrite the same information at the end of the Case. A typical workflow might look like: ``` Perform Examination ↓ Document Findings in Notes ↓ Add Screenshots / Context ↓ Continue Updating Notes ↓ Select Relevant Notes ↓ Generate Case Report ``` Notes can therefore serve both as working documentation during the examination and as source material for the final Case deliverable. See [**Monolith Case Reports**](/monolith/using-monolith/case-management/cases/case-reports/monolith-case-reports.md) for more information about creating standard Case Reports. ### Notes in Custom Report Templates Custom Report Templates can also work with Note information. A template can be designed to include or iterate through Notes when generating a custom report, allowing organizations to build reporting workflows around the documentation captured during Casework. This can be useful for organizations that want Notes to form a significant portion of a standardized final report while controlling the overall document layout and presentation. See [**Custom Report Templates**](/monolith/using-monolith/case-management/cases/case-reports/custom-report-templates.md) for additional information. ### Notes as Part of the Case Record Notes are designed to remain close to the work they document. A Case may accumulate Notes from: * General Case activity * Individual Evidence Items * Tasks * Multiple examiners * Different stages of an examination The Case Notes workspace brings that documentation together while preserving its relationship to the underlying work. This allows Monolith to act as the central record for both structured Case data and the less structured findings, observations, screenshots, and context that naturally arise during forensic work. ### Recommended Practices * Document findings as the work occurs rather than recreating examination notes at the end of the Case. * Create Evidence Notes when a finding relates directly to a specific Evidence Item. * Use Case Notes for broader findings, methodology, research, or Case-wide context. * Use Task Notes when documenting work performed as part of a specific Task. * Give Notes descriptive names so they remain easy to locate as Case documentation grows. * Use headings and lists to keep longer Notes readable. * Include screenshots when they provide useful context for a finding. * Use the Current Date and Current Timestamp slash commands when documenting time-sensitive activity. * Review Version History when earlier Note content needs to be referenced or restored. * Export individual Notes when a standalone document is useful. * Select relevant Notes for inclusion in Case Reports rather than recreating the same findings elsewhere. ### Notes Extended Walkthrough A recorded Monolith Mondays session covering the full notes system, including the topics described above. {% embed url="" %} If the video does not render, you can [watch the walkthrough on YouTube here](https://www.youtube.com/watch?v=riXF6jzoTuI) {% endembed %} ### Related Documentation * [**Cases**](/monolith/using-monolith/case-management/cases.md) * [**Evidence Items**](/monolith/using-monolith/evidence-management/evidence-items.md) * [**Tasks**](/monolith/using-monolith/dashboard/tasks.md) * [**Files**](/monolith/using-monolith/case-management/cases/files.md) * [**Monolith Case Reports**](/monolith/using-monolith/case-management/cases/case-reports/monolith-case-reports.md) * [**Custom Report Templates**](/monolith/using-monolith/case-management/cases/case-reports/custom-report-templates.md)