Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition

April 14, 2008

Chapter 3. Securing and Evaluating the Scene

Section 1 — Preliminary Interviews

First responders should separate and identify all adult persons of interest at the crime scene and record their location at the time of entry onto the scene.

No one should be allowed access to any computer or electronic device.

Within the parameters of the agency’s policies and applicable Federal, State, and local laws, first responders should obtain as much information from these individuals as possible, including:

• Names of all users of the computers and devices.
• All computer and Internet user information.
• All login names and user account names.
• Purpose and uses of computers and devices.
• All passwords.
• Any automated applications in use.
• Type of Internet access.
• Any offsite storage.
• Internet service provider.
• Installed software documentation.
• All e-mail accounts.
• Security provisions in use.
• Web mail account information.
• Data access restrictions in place.
• All instant message screen names.
• All destructive devices or software in use.
• MySpace, Facebook, or other online social networking Web site account information.
• Any other relevant information.