If the computer is ON and accessible, the traditional way to secure the evidence is to unplug the device from its power source. This prevents any unexpected changes to data that may occur during a “normal shutdown”.
The first officer to arrive at the scene should secure the scene by making sure that everyone in the area is safe and isolate the area to preserve evidence. This may include arresting suspects and obtaining medical assistance. Crime scene tape, like that shown below, is often used to help secure the scene.
10 Best Practices for Managing Digital EvidenceDocument Device Condition. ... Get Forensic Experts Involved. ... Have a Clear Chain of Custody. ... Don't Change the Power Status. ... Secure the Device. ... Never Work on the Original Data. ... Keep the Device Digitally Isolated. ... Prepare for Long-Term Storage.More items...•
It is important to consider the need to preserve the scene of the incident for investigation. Actions taken at all stages of an incident may affect the preservation of evidence. Failing to properly secure and manage a scene may allow contamination of the scene, with a resultant loss of evidence.