Documentation and evidence collection

Documentation of the scene should also be done by the first responders to aid in investigations. Documentation of the scene should include photographs, video, voice recording, and manual documentation of the following:

• The room where the device is located (desk, ceiling, entrance/exit, windows, lighting, electrical outlets, and data drops)
• The state of the device (on, off, power light blinking)
• The screen contents and whether the device is on (operating system, running programs, date and time, wired and/or wireless network connectivity)
• Books, notes, and pieces of paper
• Connected and disconnected cables

Once the scene has been secured and documented by the first responders, the forensic investigator should also be called in, if not already alerted.

If the first responder has been trained in evidence collection and preservation, they can also begin the process of acquiring what can be considered as physical evidence...