Welcome back to the computer forensics path,
Course 6, Module 2.
We're going to talk about documenting the scene.
When we arrive on the scene,
the first thing we want to
do when we're executing a search warrant,
is we want to,
once entry is made, take photographs.
Once you make entry and the scene is
secure because safety is first,
we're going to take photographs.
We're also going to make a video and you
can use hand-drawn diagrams.
I highly recommend doing all three of these things.
Couple of reasons.
One reason is you want to be able to look at the scene
as you found it before
people touch things and move them around.
The other reason is you want to document
the condition of even the residents
or the business as it was when you got there.
This is to protect you so that you can show
that there was previously existing damage if there was.
You definitely want to do all three of those things.
When we document evidence,
we're documenting the condition of the evidence.
Not only if there's any obvious damage,
but we're documenting it as being on or off.
We're talking about electronic
evidence for the most part,
was this device on or off?
We're going to look for destructive processes running,
and we're going to get into this
much more in upcoming modules.
Is there anything that shows that
drives are being wiped or evidence is being destroyed?
We're also going to want to look for signs of encryption.
We definitely want to
isolate the devices from the network.
We want to control Internet connectivity because we can
have devices wiped or evidence altered over the Internet.
Changes can be made to
this evidence and we do not want that.
That's why when you're making entry,
one of the first things you want to do is secure
the suspects and get everybody away from their keyboards.
Then we want to isolate
the devices from the network to
prevent destruction of evidence.
We want to document our actions always, always, always.
We're going to document what we did and why we did
that so that when we're questioned later,
we have an answer for that.
In our next module,
we're going to talk about recognizing digital evidence.