What are the eight steps in documenting the computer crime scene?

Question

What will be an ideal response?

Answer 1

Documenting the Scene

1. Both in the report and by video and photography identify the location, type of devices, their condition, and power status. Get views of all sides, including the backs, where cables are attached.
2. Record all activity and processes visible on the monitor.
3. Note all devices physically connected to the computer as well as the same for wireless components. Record their serial numbers, the content of "sticky notes" attached to them, and related written information.
4. Note the condition and power status of the computer's network access.
5. Document, photograph, and sketch all wires, cables, and devices connected to, or inserted in, the computer.
6. Tag every cable as to where each end was attached.
7. Document and photograph every wireless device in the locations at which they were found.
8. Document and photograph the locations of related evidence, such as printed pages of Internet addresses, financial records, images, computer code, GPSs/maps/directions, electronic money transfers, books on hacking, software packages, lists of computers accessed and dead drops, credit card information, reproductions of signatures, checks and money orders, diaries and calendars, mail in victims' names, cash, fictitious identification, passwords and information on encryption, and steganography. ("Steg" or "Stego" has been used for thousands of years. Historically, steg means writing in a cipher or code so that only the sender and the recipient know what the message means. In the context of computers, steg means hiding a file in a larger file so that others are not aware of its presence or meaning.)