Digital devices are so versatile that every crime scene entails one or more components of digital evidence. Conducting a proper forensic analysis on this very kind of evidence can surely take some time, but it is usually the actions undertaken during the initial evidence gathering that has the power of making or breaking the case. Elijaht m&a due diligence has listed some of the most common errors committed on scene so as you can steer clear from them by all means. You’re welcome!
- Not being able to isolate a seized mobile phone from cellular or wireless networks
The gist of seizing a device is to analyze and investigate the info it entails, but having control over a device doesn’t mean you have control over the data access. If the mobile can connect to any network, the data it contains is posed at risk. Mobiles are syncing on a consistent basis with the cloud based services that stores all data. The background process has the power of corrupting or ruining the digital evidence. This very feature doesn’t need much of technical knowledge to implement. If the device is on and accessible, then you just have to turn off access to any remote connection by putting it on airplane mode. If the mobile is on and not accessible, you can switch the phone off and remove the battery.
- Turning on a computer
When a computer is seized, it is too tempting to seek inevitable evidence. In case of immediate threat or terrorism, you need to power on a computer. But, there are many background processes that it is deemed a mistake from the proper digital evidence handling. You cannot put a stop to the background processes. Even though they don’t affect the particular evidence that is essential for the case, the fact that the system connected to the web means the info is at risk for being remotely deleted or altered. If the system is off, and you don’t need it, don’t turn it on. The digital forensic examiners use a specific equipment that lets them access the storage of a computer system without turning the computer on. Many labs have mobile or field versions of this equipment to perform an on scene analysis with no kind of corruption of the evidence. When planning a seizure, you will need instant access to info on a computer or a hard drive. You need to plan on the basis of the same in order to protect the digital evidence.