Collecting Evidence at Multiple Sites

Scenario*: You are a detective for the local police. You have some training in computer forensics. The primary suspect in a murder investigation works at a large local firm. He is reported to have two computers at work in addition to one at home. His company has issued him a cellphone for business use, but you do not know if this is the only cellphone he has or uses. You are the first responder to both scenes. So, what do you do? To get the discussion started: What are the least harmful ways to technically engage with the scene at the suspect’s office ? the scene at the suspect’s home? What obstacles can you expect to encounter at the suspect’s office? At the suspect’s home? In what ways does your engagement alter the digital evidence? With three computers, the chances are pretty good that at least one of them will be turned on and one of them will be turned off. What are the risks of turning a computer on or off at the scene? Should you take a disk image at the scene? Or, should you take the computer to your lab to make the image? What tools would you use to take an image? What should you do with digital devices other than computers which you encounter? What’s happening in the news right now to support your viewpoint? Be prepared to both defend your position and challenge the position of others. * This scenario used Case Project 4-1 (Nelson and others, 2015, p. 180) as its starting point. CITE: Nelson, B., Phillips, A., & Steuart, C. (2014). Guide to computer forensics and investigations. Cengage Learning  CHAPTERS 4,6,9