Evidence collection and documentation
The documentation of the scene should also be performed by the first responders to aid in investigations. The documentation of the scene should include photographs, video, voice recording, and manual documentation of the following:
- The room that the device is located in (desk, ceiling, entrance/exit, windows, lighting, electrical outlets, and data drops)
- State of the device (on, off, power light blinking)
- Screen contents, if the device is on (operating system, running programs, date and time, wired and/or wireless network connectivity)
- Books, notes, or pieces of paper
- Connected and disconnected cables
- Peripherals such as printers, scanners, and external drives in close proximity (whether connected or not)
Once the scene has been secured and documented by the first responders, the forensic investigator should also be alerted and called in to further examine and assess the situation.
If the first responder has...
