What are some of the guidelines investigators must adhere to when dealing with physical evidence in a computer crime case?

Question

What will be an ideal response?

Answer 1

• According to the National Institute of Justice (NIJ), "First responders must avoid… using any tools or materials that may produce or emit static electricity or a magnetic field as they may damage or destroy the evidence.". Further, the NIJ recommends that "First responders should also have radio frequency­shielding material such as faraday isolation bags or aluminum foil to wrap cell phones, smart phones, and other mobile communication devices after they have been seized" (National Institute of Justice, 2008, pp. 13–14).
• The NIJ also cautions that "Without having the necessary skills and training, no responder should attempt to explore the contents or recover data from a computer (e.g., do not touch the keyboard or click the mouse) or other electronic device other than to record what is visible on its display" (National Institute of Justice, 2008, p. 6). First responders and investigators must be aware that destruction of the program or of information files may be programmed in so that any attempt to access the information or to print it will cause it to self-destruct. Officers should also check for a hardware disabler.
• Because chemicals used in processing fingerprints can damage electronic equipment and data, latent prints should be collected after electronic evidence recovery is complete.
• A backup of the hard disk contents should be made as quickly as possible. A portable hard drive duplication tool is available that lets investigators quickly create a mirror image of one or more hard drives in the field without removing the original to a remote site.
• Investigators should avoid contact with the recording surfaces of computer tapes and disks. They should never write on disk labels with a ballpoint pen or pencil or use paper clips or rubber bands with disks, because to do so may destroy the data they contain.