Process the Scene for Physical Evidence | Windows Forensics: The Field Guide for Corporate Computer Investigations

The processing of the scene for physical evidence is best left to those individuals who have been specifically trained to process it. The processing of the physical evidence should always take place prior to any processing of digital evidence unless there is reason to believe a delay in processing the digital evidence will result in its destruction or loss.

In addition to the digital evidence they may hold, electronic devices are frequent repositories of physical evidence. Anyone who has ever turned over a keyboard and examined the detritus that can be shaken out is aware of potential biological evidence. Likewise, anyone who has touched a computer screen has left his own mark for later examination. Indeed, computer screens and mice are excellent locations for fingerprints , frequently better than those on the textured keys of a keyboard.

The computer investigator can suggest items of interest in the digital investigation, which may be processed as part of the physical investigation. These include:

Post-it notes or scraps of paper on, around, or under desks and computer equipment. Check under the keyboard. Post-its are an office favorite for writing down passwords.
Papers with passwords, user names , or URLs. Any papers with information about the individual's computer system or potential usage should be collected.
Keys to laptops or locked drives . They can be taped under desks or hidden in plants.
Media. Any floppy disks, CD-Rs, CDs, or other removable media should be collected for analysis. Additionally, application CDs might be necessary to load an individual application in the lab environment for analysis.
Computer manuals, reference guides, and other electronic equipment documentation. These guides may be useful in taking apart a system, figuring out what command accesses CMOS setup, and understanding an application.

EVIDENCE COLLECTION KIT

The collection of physical evidence at a crime scene requires the appropriate equipment for handling and processing. A fingerprint analyst without a dusting kit, a DNA collection expert without swabs, and a forensic entomologist without sample cases would be severely limited in their abilities to process a scene. Similarly, without the basic kit, the computer forensic analyst is like a carpenter without a saw.

Not all digital evidence processing kits are alike. Some analysts prefer to have a complete mobile lab available to them for on-site analysis. Companies such as DigitalForensics provide special purpose equipment for these scenarios. Other analysts work on a first responder model whereby evidence is collected by remote first responders and then shipped to a central location for analysis. The sophistication of the evidence collection toolkit depends on the response model used, but at a minimum the following items should be included in any forensic response toolkit:

Latex gloves. Not only do they prevent one from leaving fingerprints everywhere, but thicker latex gloves are also good protection against jagged edges when pulling apart computers.
Security tape. The computer forensic analyst in a corporate setting may be acting alone and may need to cordon off an area as part of a physical crime scene. Basic yellow "Do Not Cross" tape can be purchased at local hardware stores. It is sufficient for non-law enforcement use.
Evidence tags and labels. Tags specifically designed for evidence collection can be purchased cheaply from any major supplier of law enforcement goods. They should be tamper-resistant and may have two parts : one that stays with the evidence and a second that remains in the custody of the analyst.
Cable ties. Securing a label to a piece of evidence via adhesion may not always be possible. A few inexpensive plastic cable ties do the trick nicely .
Bolt cutters. Many laptop locks can be bypassed with a pair of scissors and a paper clip. Key locks require a little practice, and number locks require a lot of time. If time is of the essence, a set of bolt cutters or cable cutters will make quick work of inexpensive cable locks.
Sharpies . When writing on a CD-R, evidence tag, or any other surface, a Sharpie is unbeatable. Make sure that the pen has a felt-tip, preferably a fine point or better for those tight spaces.
Anti-static bags and evidence bags. Anti-static bags are generally silver in color and protect computer equipment for static electricity both in the environment and generated by the analyst. Evidence bags are tamperresistant and have a detachable evidence label. Buy several different sizes of each, ranging from floppy-disk size to laptop- size .
Digital camera. Any digital camera with a time and date stamp will suffice. Look for a built-in macro lens for close-ups of network connections, components , and cables. Anything above three megapixels is sufficient. Do not attempt to compete with Ansel Adams.
Forensic notebook. Any book with numbered pages that cannot be removed is good for this one. Lab notebooks and general bound logbooks tend to be cheaper and just as good as those sold specifically for the purpose.
PC toolkit. This is one place not to skimp. Buy the larger-size PC toolkit (one hundred pieces or better) to get everything needed to take a machine apart on-site. Ensure that TORX bits are included.
Forensic laptop, hard disk, and adapters. It is always nice to be able to do some analysis on-site. A basic laptop with external USB 2.0 or FireWire hard disk along with a hardware write-blocker helps here.

Tip

Before destroying a laptop lock, try looking around the office for a hidden key, either taped under the desk or in an office plant. Some locks can even be picked with a Bic pen (see http://www.wired.com/news/culture/0,1284,64987,00.html for details).

Basic combinations on a number lock are worth a try also; the phone extension of the particular desk is a favorite one. Combinations can be brute-forced in a fairly short period. Four-digit locks have 10,000 combinations that can be tested in roughly an hour and a half.