Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition

April 14, 2008

Chapter 7. Electronic Crime and Digital Evidence Considerations by Crime Category

Introduction

The lists of electronic crime and digital evidence considerations presented in this chapter are not exhaustive, but are intended to assist a first responder identify sources of potentially valuable digital evidence by crime category. Depending on the complexity of the scene and the situation, the first responder may need to request more advanced technical assistance.

In some circumstances, trace, latent, or biological evidence such as fingerprints or DNA that may be important to the investigation may be present on computers and their components or on other electronic devices. First responders should follow agency procedures for collecting such evidence. Any destructive processes associated with recovering or analyzing trace, latent, biological, or other evidence should be postponed
until after the digital evidence has been recovered for examination and analysis.

To assist in the forensic examination, the first responder should document the following information when possible:

• A summary of the case.
• Passwords to digital evidence seized.
• Investigation point-of-contact information.
• Preliminary reports and documents.
• Keyword lists.
• Suspected criminal activity.
• Suspect information including nicknames.