Is it "absolutely" necessary we have logs of what actions/queries we as an analyst do on a forensic image? Is this a requirement for maintaining transparency or reproducibility?
Note that I am not talking about acquisition part but purely analysis/processing/post-acquisition part.
For e.g., let's say you are operating on an android device image. You queried msgstore.db through SQLite syntax to look for certain keyword occurence or to filter within specific timeline. Is it necessary or suggested that you should have log of that query? Same goes if you accessed any other files, doesn't matter if it's worth of investigation or not. If the answer is yes, should this be done at application level or analyst is manually supposed to do this?
I am assuming the answer is mostly yes but does it mean you do this for all cases or only when there is requirement for so?