Title: 6. Seizing Digital Evidence at the Scene
Course: IN 2005 Digital Forensics > Section: Module 5: Chapter 5 - Processing Crime and Incident Scenes

Seizing Digital Evidence at the Scene

1. Law enforcement can seize evidence with a proper warrant.  Corporate investigators rarely can seize evidence.
2. Seizing digital data must follow standards defined by the U.S. Department of Justice (DoJ) for both criminal and corporate investigations.
3. When seizing digital data, always consult with your attorney for guidelines on how to proceed.

Preparing to Acquire Digital Evidence

1. The evidence you acquire at the scene depends on the nature of the case and the alleged crime or violation.
2. List some of the questions that you need to ask your supervisor or senior forensics examiner in your organization before acquiring digital evidence, including:
  - Do you need to take the entire computer and all peripherals and media in the immediate area?
  - How are you going to protect the computer and media while transporting them to your lab?
  - Is the computer powered on when you arrive?
  - Is the suspect you’re investigating in the immediate area of the computer?
  - Is it possible the suspect damaged or destroyed the computer, peripherals, or media?
  - Will you have to separate the suspect from the computer?

Processing an Incident or Crime Scene

1. Prepare a list with guidelines for processing a crime scene.  The list should include guidelines for securing the area, dealing with live computers, securely saving files, properly closing current applications and shutting down the computer.
2. The steps to properly bag and tag evidence, including:
  - Assign one person, if possible, to collect and log all evidence
  - Tag all the evidence you collect with the current date and time, serial numbers or unique features, make and model and the name of the person who collected it
  - Maintain two separate logs of collected evidence
  - Maintain constant control of the collected evidence and the crime or incident scene
  - You should also look for information related to the investigation, such as passwords, passphrases, PINs and bank accounts.  Finally, collect documentation and media related to the investigation.

Processing Data Centers with RAID Systems

1. Sparse acquisition is a technique for extracting evidence from large systems.  It extracts only data related to evidence for your case from allocated files and minimizes how much data you need to analyze.
2. One drawback of this technique is that it doesn’t recover data in free or slack space.

Using a Technical Advisor

1. A technical advisor can help you list the tools you need to process the incident or crime scene. The advisor is the person guiding you about where to locate data and helping you extract log records or other evidence from large RAID servers. A technical advisor can also help create the search warrant by itemizing what you need for the warrant.
2. The responsibilities assigned to external advisors, including:
  - Know aspects of the seized system
  - Direct investigators handling sensitive material
  - Help securing the scene
  - Help document the planning strategy
  - Conduct ad-hoc trainings
  - Document activities

Documenting Evidence in the Lab

1. You should be sure to record your activities and findings as you work.  For this, maintain a journal to record the steps you take as you process evidence.
2. Your goal is to be able to reproduce the same results when you or another investigator repeat the steps you took to collect evidence.
3. A journal serves as a reference that documents the methods you used to process digital evidence.

Processing and Handling Digital Evidence

1. You must maintain the integrity of digital evidence in the lab as you do when collecting it in the field.
2. The steps to create image files, including:
  - Copy all image files to a large drive
  - Start your forensics tool to analyze the evidence
  - Run an MD5 or SHA-1 hashing algorithm on the image files to get a digital hash
  - Secure the original media in an evidence locker