Documentation and evidence collection
Documentation of the scene should also be done by the first responders to aid in investigations. Documentation of the scene should include photographs, video, voice recording, and manual documentation of the following:
- Room that the device is located in (desk, ceiling, entrance/exit, windows, lighting, electrical outlets, and data drops)
- State of the device (on, off, power light blinking)
- Screen contents, if the device is on (operating system, running programs, date and time, wired and/or wireless network connectivity)
- Books, notes, pieces of paper
- Connected and disconnected cables
Once the scene has been secured and documented by the first responders, the forensic investigator should also be called in, if not already alerted.
If the first responder has been trained in evidence collection and preservation, they can also begin the process of acquiring what can be considered as physical evidence.
Examples of physical evidence include:
- Computer towers.
- Laptops.
- Tablets...