±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 2 Overall: 36324
New Yesterday: 2 Visitors: 180

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Details recorded about exhibits

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

minime2k9
Senior Member
 

Details recorded about exhibits

Post Posted: May 01, 16 11:53

So this thread is kind of a follow on from the BIOS/UEFI post.
I'm interested to know what others, preferably in a professional capacity (LE or Private), record about an exhibit as part of the imaging process.
So Make, Model and Serial of device to me seem like a fairly sensible start, but how far do people go?
Processor/Memory capacity?
Output ports (USB/HDMI etc)
BIOS make and revision?
To go alongside that, does everyone photograph the exhibit when its being imaged and what key things are photographed?  
 
  

UnallocatedClusters
Senior Member
 

Re: Details recorded about exhibits

Post Posted: May 01, 16 22:14

I take photographs of the device I am imaging to capture labels with serial numbers. If there is significant physical damage to a device, I will also photograph the damage to record the fact that it was provided to me damaged.

I also take a photograph of smartphones, with the smartphone laying on top of the Chain of Custody document for the phone (without covering up COC information I have recorded obviously).  
 
  

minime2k9
Senior Member
 

Re: Details recorded about exhibits

Post Posted: May 02, 16 14:15

So do you fill details into a form or do you take photos instead?  
 
  

pbeardmore
Senior Member
 

Re: Details recorded about exhibits

Post Posted: May 12, 16 14:53

I make a positive record of empty slots/sockets if that makes sense. Its very easy for the suspect to claim the was an SD card that was seized and it had crucial evidence or priceless baby photos etc. Also , the client may not be as careful during the seizure so you need to cover yourself. I have seen SD cards not recorded during the seizure on many occasions (I often wonder what the legal situation is with that data)  
 
  

jhup
Senior Member
 

Re: Details recorded about exhibits

Post Posted: May 13, 16 00:28

Collectors often photograph the device in situ from all possible angles. I am never on collection site.

If it is a device that we take apart, we have multiple digital cameras that record the entire process.

I personally also talk, which gets recorded. This way I can go back to the video and ask what I was doing. "Pouring 30 cc-s of hydrofluoric acid into beaker... [email protected]# WHAT THE [email protected]$#%#!" and such...  
 

Page 1 of 1