Something wrong? What to do to preserve evidence on a computer or system
Preserving Evidence is the first priority, therefore there are steps to be taken which may prove vital later on
Something not to be forgotten is that those first on a scene should take steps to ensure the safety of all persons and of course to ensure the integrity of evidence. All activities should adhere to your company's organisational policy and the law. Ideally, of course, a locus will be left alone until qualified personnel are available. If you can, visually identify potential evidence whether physical or electronic and evaluate whether any is fragile
Try not to touch! If at all possible don't move anything; leave equipment on that is switched on and equipment off that is switched off. It is a good idea to take some digital photographs of where equipment lies which can match the photographs we take, demonstrating that equipment has not been altered in any way - possibly important in an evidential process later on. Disconnect telephone lines, but from the wall rather than the machine
Fingerprints may be on peripherals such as the computer mouse or CD's. We have an in-house fingerprinting department that works in conjunction with IT forensics. A scene examination may be appropriate, for example in demonstrating that a particular person has used the machine through lifting of prints from a mouse on-scene. Chemicals used in the processing of prints may damage equipment or date therefore the manner in which equipment is handled is important
Documentation and Chronology - Maintaining a chain of evidence and documenting activity is an ongoing process starting with recording the location and condition of all units, whether subsequently forensically examined or not. Simple issues may have relevance - such as a mouse being on the left hand side rather than right, indicating a left handed user. The condition of the CPU, disturbance of dust and whether it is on or off, or on and warm, are all recorded. We will take locus photographs of the front of the machine, screen, environment and other processes
Forensic evidence may be crucial in investigation of the misuse of company information by an ex-employee, Internal theft or fraud, analysis of email and deleted files, Pornography and illegal downloads, Data Recovery, Paedophilia, Substance Abuse and dealing, misuse of the internet or Theft of Intellectual Property (e.g. databases)
Evidence gained from computer investigation was instrumental in thie Employment Tribunal case reported in the Daily Telegraph
Rebuilding deleted evidence from a corporate laptop or terminal is often crucial in fraud and employee investigation
Similarly, a legal investigation of a computer will yield the evidence needed for a contentious litigation or other issue
Step by Step advice on preserving an evidence scene will produce the best result possible for analysis
What immediate action to take if you suspect a machine may have been compromised or may contain evidence
