Title: 4. Preparing for a Search
Course: IN 2005 Digital Forensics > Section: Module 5: Chapter 5 - Processing Crime and Incident Scenes

Preparing for a Search

1. Preparing for a computer search and seizure is probably the most important step in computing investigations.
2. To perform these tasks, you might need to get answers from the victim and an informant, who could be a police detective assigned to the case, a law enforcement witness or a manager or coworker of the person of interest to the investigation.

Identifying the Nature of the Case

1. When you’re assigned a computing investigation case, you start by identifying the nature of the case, including whether it involves the private or public sector.
2. The nature of the case dictates how you proceed and what types of assets or resources you need to use in the investigation.

Identifying the Type of Computing System

1. For law enforcement, this step might be difficult because the crime scene isn’t controlled.  If you can identify the computing system, estimate the size of the drive on the suspect’s computer and how many computers you have to process at the scene.
2. You should also determine which OSs and hardware might be involved.

Determining Whether You Can Seize a Computer

1. The type of case and the location of the evidence determine whether you can remove computers from the scene.
2. Law enforcement investigators need a warrant to remove computers from a crime scene and transport them to a lab.  In addition, if removing the computers will irreparably harm a business, the computers should not be taken offsite.
3. The additional complication of files stored offsite that are accessed remotely.
4. If you aren’t allowed to take the computers to your lab, then you need to determine the resources you need to acquire digital evidence and which tools can speed up data acquisition.

Obtaining a Detailed Description of the Location

1. Get as much information as they can about the location and conditions of the crime scene location.
2. If you have to deal with hazardous materials, keep a tight interaction with your HAZMAT team and follow the HAZMAT guidelines, including:
  - Protect your safety and health
  - Protect the evidence
  - Put the target drive in a special HAZMAT bag; the HAZMAT technician can then decontaminate the bag
  - Check for high temperatures

Determining Who Is in Charge

1. The differences between corporate computing investigations and investigations handled by law enforcement agencies.

Using Additional Technical Expertise

1. Situations where you may need the help of specialists. For example, when dealing with special operating systems, RAID servers or databases like Oracle.
2. Specialists need to be trained in proper investigation techniques to avoid damaging the evidence.

Determining the Tools You Need

1. You should prepare your tools using incident and crime scene information.
2. See Figure 5-5 and Tables 5-1 and 5-2 to explain how to construct and when to use an initial-response field kit and an extensive-response field kit.

Preparing the Investigation Team

1. The importance of reviewing all the details about the incident with the investigation team to produce a coordinated plan of action for collecting and securing the evidence.
2. A slow response can cause digital evidence lost.