Upon arriving at the scene of the incident, it will be the team’s responsibility to secure the location so everyone can enter the office building. After the security perimeter is set up, the forensic team can enter to start conducting the seizing of the computer in question.
The computer forensic team can start by taking photographs of everything regarding the computer. These photos will include current screen shots of the setup, position of the mouse, keyboard, monitor, condition of the tower/laptop and any and all existing wires. After the photos, the investigators will photograph the existing monitor and what is showing on the monitor. This will be done to help us document user names, computer name and other information that can be shown on the log in screen.
As we know, evidence can be lost if the system is shut down or needs to be shut down prior to being relocated to the lab. The next process is to physically collect all pertinent evidence, in this case it will be the computer that is locked and at this time only the administrator is able to unlock it. Since it is locked, we need to focus on following the correct procedures to allow the best way to shut it down and transport it without losing any evidence. We will follow the proper shut down procedures of Windows 2000 Server, which is to press the start button and select shut down.
The investigators will start the process of tagging and bagging each wire, peripheral, the monitor, mouse and the computer itself. This is done so each wire is accounted for and to ensure that all the same wiring is available to be used in the lab so the investigators can duplicate the same set up of the computer system as it was found in the office location. Each label is to be made with a letter and placed on the corresponding port it is assigned to. For example, wire A is labeled and port A is labeled, identifying that wire A is to be plugged into port A. We also need to ensure that each label or sticker is placed towards the end of the wire and clearly placed near or next to the proper port.
The chain of custody starts with the tagging and bagging of the evidence and plays an important role during the investigation. If anything were to happen to the evidence, the investigators can look back and find out who bagged and tagged the evidence and find out what happened to it. Due to the nature of computer parts and peripherals, the best way is to use a brown paper bag which gives enough room to place all the parts into it. Anti-static bags and cases are also recommended to be used in case the storage of hard drives, flash media, memory modules, video and sound cards need to be examined and used as evidence. While labeling information on a tag, it is important to remember not to leave out any details and be as thorough and accurate as possible.
After all evidence is collected, labeled and properly stored for transport from the scene to the lab. We need to take into consideration any potential road obstacles such as sudden change in speed such as sudden stops, stop lights etc. Any shifting of the evidence can damage or potentially alter the data. We also need to remember to keep it from any magnets, such as the lights used in unmarked police vehicles that are temporarily attached to the roof via a strong magnet in their base.
At the arrival to the lab, all evidence is to be logged into an evidence log, database or the proper method followed to document its arrival and then securely placed in the evidence room to ensure its integrity is not compromised until the investigators are able to start their investigation and gather evidence to be recorded. This procedure does require evidence seals to be broken on the bags in order to examine each computer component. We also will be required to document this onto the log book or database and also when we need to reseal, rebag or retag evidence and return it to the proper storage location. This will give us the paper trail needed to be used in court and show that the proper handling, storage, documentation and gathering of evidence was used and presented to the authorities.
This essay has been submitted by a student. This is not an example of the work written by our professional essay writers. You can order our professional work here.