Computer Evidence Handling by Ken Diliberto, Network Systems Specialist
Often times people who are not familiar with the specific workings of a computer worry~ about how to store a computer held in evidence. Will we lose valuable data that can make or break the case? Does the computer or disks require special handling? What special concerns should be addressed? Here is a list of precautions that will make handling computer evidence safe and successful when prosecuting any case. Collecting Computer Evidence Computer related evidence is like any other evidence you might find with one exception, IT TENDS TO BE VERY VOLATILE AND CAN EASILY BE DAMAGED OR DESTROYED. Handle all computer evidence with extra care. Follow the suggestions listed below. Never turn off power to a computer or FAX machine until you are certain the memory has been saved. When you have a case involving a computer or FAX Machine as the object or means of committing a crime, do not turn the computer off if it is on until you are sure the data in temporary memory has been "saved". If this is a suspects computer system, do not let the suspect touch the system. (All data can be wiped out forever with just one key stroke.) Generally speaking you do not have to be an expert on the item in order to safely collect computer related evidence, rather you simply follow some general guidelines and procedures which can be easily applied to over 90% of the items you will encounter. You should take the following steps: Don't place the items near excessive heat, or indirect sunlight inside your car. Avoid magnetic fields. These include but are not limited to your car radio (in the trunk next to the transmitter), electric motors, speakers, magnetic clips, etc. Avoid touching exposed media with your skin. The oil could damage the media. This includes all disks. Avoid touching exposed wires or circuit boards. The static electricity which you can unknowingly, carry on your body may destroy the components. DO NOT place the items in plastic evidence bags. The bags are full of static electricity and will cause permanent damage. Use paper bags to package and protect the items. Treat the items gently and with care, don't drop or throw them. Don't pile heavy objects on top of them. Look around and ask the suspect if he has the original packing material (be cautious, apply the above listed rules to any items he might suggest). Often the suspects care more about protecting their equipment than anything else. If original packaging is not available use a paper bag or cardboard box. Don't photocopy diskettes to obtain information from the labels. Photograph them instead. The heat and electrical fields generated by photocopy machines will likely degauss (magnetically erase) the diskettes. Tag each wire, cable or other connector before it is removed, together with the port from which it is removed, to facilitate accurate replacement. Masking tape can be used to mark the cord with #1, and the port (place) the cord was removed from with # I. If the computer has to be reconstructed, it becomes as easy as 1-2-3. Local computer stores have easy to use tags for disassembling and reassembling computer components. Follow the normal evidence collection procedure that you would with any other type of evidence. Take pictures, mark and tag the items with the locations from which they were seized. Tags and photographs can be crucial when the time comes to reassemble the equipment for examination or for court. When equipment is seized be sure to take all manuals, cables and components that relate to the seized items, these will probably be required for the analysis. If the equipment is to be seized make certain that there is a current backup. A "backup" is a recent copy of the information contained on the system, which can be used to restore the information if the original should be damaged. No matter how careful you are when moving a system, there is a substantial risk in losing whatever information might be contained on the systems Hard Disk (a device installed in the computer which is capable of storing large amounts of information on magnetically treated platters). Much of the information could be irreplaceable. Types of evidence can include: Printouts ledgersOther forms of evidence can include: Computers, keyboards and monitors Golden Rule for storage of electronic/computer equipment: If you are comfortable,
Storage Location Suggestions Store in temperatures between 60 and 90 degrees Fahrenheit with low to mild humidity. Store in dust free environments Store away from strong magnetic fields. Don't place a box of disks next to a large stereo speaker. Do not store near a working telephone that has· a bell type ringer. Storage of electronic/computer equipment and components will often be for extended periods of time due to the nature of the case and related complexity. Due to the "young nature" of computer crimes, nearly all current computer related crimes are on appeal due to the lack of case law. Often computer evidence must be held for several years while the appeals process is completed. General Storage Recommendations: Store separately. If possible have a separate location from "normal" evidence to store electronic/computer related evidence. Investigators and attorneys may need to check and evaluate parts of the evidence on more than one occasion. It will probably be stored there a long time. Keep all the evidence for each computer case together. It is often necessary to reassemble the computer for tests and backup and demonstration. One misplaced piece or cable can cause great difficulty in reassembling the unit. Use wood shelves and cabinets when possible for storage. Metal can increase the risk of static electricity. Ensure each item is properly tagged and identified. Electronic/computer evidence has a language for naming items all its own. When called on to locate evidence and check it out or return it, you need to know what to look for when the tag says "Multi I/O board with 16550a UART". Small and similar items such as computer disks should be placed in individual envelopes or small boxes and stored together in one large box. Each small envelope should identify the contents and labels on the outside of the large box should identify the small envelopes and boxes contained inside. When packaged in envelopes and boxes, evidence· is further protected from magnetic fields and dust. Handle chips and circuit boards with care. Static electricity
and hand oils can damage them. Handle boards and chips by the edges and
avoid touching them on their connectors. Copyright © 1999 International Association for Property and Evidence, Inc. Reprinted from the Evidence Log, Volume 1995, Number 1, Page 3 |
