So this thread is kind of a follow on from the BIOS/UEFI post.
I'm interested to know what others, preferably in a professional capacity (LE or Private), record about an exhibit as part of the imaging process.
So Make, Model and Serial of device to me seem like a fairly sensible start, but how far do people go?
Processor/Memory capacity?
Output ports (USB/HDMI etc)
BIOS make and revision?
To go alongside that, does everyone photograph the exhibit when its being imaged and what key things are photographed?
I take photographs of the device I am imaging to capture labels with serial numbers. If there is significant physical damage to a device, I will also photograph the damage to record the fact that it was provided to me damaged.
I also take a photograph of smartphones, with the smartphone laying on top of the Chain of Custody document for the phone (without covering up COC information I have recorded obviously).
So do you fill details into a form or do you take photos instead?
I make a positive record of empty slots/sockets if that makes sense. Its very easy for the suspect to claim the was an SD card that was seized and it had crucial evidence or priceless baby photos etc. Also , the client may not be as careful during the seizure so you need to cover yourself. I have seen SD cards not recorded during the seizure on many occasions (I often wonder what the legal situation is with that data)
Collectors often photograph the device in situ from all possible angles. I am never on collection site.
If it is a device that we take apart, we have multiple digital cameras that record the entire process.
I personally also talk, which gets recorded. This way I can go back to the video and ask what I was doing. "Pouring 30 cc-s of hydrofluoric acid into beaker… !!@# WHAT THE !@$#%#!" and such…