OPOTA- Unit 11 Topic 2
What first responders should ensure before collecting a device that may hold electronic
evidence - ANS-a) The scene has been secured and documented
b) Legal authority exists to seize evidence
c) Appropriate personal protective equipment is used
Preserving digital evidence from computers - ANS-a) Collect any forensic evidence (e.g. DNA,
fingerprints), if applicable
b) Photograph the surrounding area prior to moving any evidence
c) Photograph the surrounding area prior to moving any evidence
d) Photograph the front and back of the computer and make a diagram of any cords
and connected devices
e) If the computer is off, leave it off. Do not power it on to begin searching it
f) If you reasonably believe the computer is destroying evidence (e.g. remothe wipe,
remote formatting of the hard drive), immediately shut down the computer by
removing the power cord from the back of the computer
g) If the computer system is a laptop, unplug from the power source (uf necessary),
remove the battery (if possible), attempt to force a shutdown by holding down the
power button
h) If the computer is a laptop
i) Unplug from the power source (if necessary)
ii) Remove the battery (if possible)
iii) Attempt to force a shutdown by holding down the power button
i) If the computer is on, contact should be made with a properly trained Computer
Forensic Examiner/Analyst in order to determine how to proceed
Preserving Digital evidence from mobile devices - ANS-a) Dumb phones (e.g. older cell phones,
flip phones)
i) Power off
ii) Remove battery
iii) Place in evidence bag
iv) Document chain of custody information on evidence tag
b) Smart devices (e.g. iDevice, Android)
i) If it is powered off, leave it off
What first responders should ensure before collecting a device that may hold electronic
evidence - ANS-a) The scene has been secured and documented
b) Legal authority exists to seize evidence
c) Appropriate personal protective equipment is used
Preserving digital evidence from computers - ANS-a) Collect any forensic evidence (e.g. DNA,
fingerprints), if applicable
b) Photograph the surrounding area prior to moving any evidence
c) Photograph the surrounding area prior to moving any evidence
d) Photograph the front and back of the computer and make a diagram of any cords
and connected devices
e) If the computer is off, leave it off. Do not power it on to begin searching it
f) If you reasonably believe the computer is destroying evidence (e.g. remothe wipe,
remote formatting of the hard drive), immediately shut down the computer by
removing the power cord from the back of the computer
g) If the computer system is a laptop, unplug from the power source (uf necessary),
remove the battery (if possible), attempt to force a shutdown by holding down the
power button
h) If the computer is a laptop
i) Unplug from the power source (if necessary)
ii) Remove the battery (if possible)
iii) Attempt to force a shutdown by holding down the power button
i) If the computer is on, contact should be made with a properly trained Computer
Forensic Examiner/Analyst in order to determine how to proceed
Preserving Digital evidence from mobile devices - ANS-a) Dumb phones (e.g. older cell phones,
flip phones)
i) Power off
ii) Remove battery
iii) Place in evidence bag
iv) Document chain of custody information on evidence tag
b) Smart devices (e.g. iDevice, Android)
i) If it is powered off, leave it off
