Describe ten things that you might find in a forensic field kit.

Question

What will be an ideal response?

Answer 1

Among the things a kit may include are the following:

Forensic laptops that have multiple operating systems and can be dedicated to the field kit, which ensures that no prior evidence from using the laptops contaminates the investigation

Call list with subject-matter experts in various IT technologies, management, and other stakeholders in the incident management process

Cell phones with extra batteries and chargers for continuous communication during the investigation

Hard drives, blank CDs, blank DVDs, and USB flash drives (sanitized and free from prior evidence) to use for evidence collection

Imaging software or hardware with write blockers

Forensic software and tools to perform the forensic data collection and analysis

Ethernet tap to sniff network traffic; this can be a DIY project using a simple switch or pre-packaged products

Cables to provide access to other devices; these can be crossover cables for system-to-system communication, Ethernet cables, USB cables, or serial cables

Extension cords and power strips to power all the equipment in areas that have few or have hard-to-reach outlets

Evidence bags, seals, and permanent markers used to store and label evidence; the bags should be antistatic and might need desiccants in order to absorb any moisture

Digital camera with photographic markers and scales to take detailed photos of an investigation area-also, tie-on labels (for identifying cables, etc.)

Incident forms (if used), extra notebooks, and a generous supply of pens for detailed logging of the investigation

Computer toolkit with various bits to handle a wide variety of computer screws, assortment of spare screws, antistatic mats and straps, mechanics? ' mirrors, telescoping lights and grabbers, and other tools that may come in handy for opening computer equipment