You must know - how it happens in their execution. Unless you're a schoolkid, of course.
Search tactics
When the evidence sought may be contained on computer media, the search should be conducted in accordance with the rules outlined below to ensure legality and evidentiary force. Computer media includes removable and non-removable magnetic disks, compact discs (CDs), DVDs, flash drives, optical discs, magnetic cards, digital tapes, and some others. Such media may be contained in personal computers, servers, communication equipment, handheld computers (PDAs), communicators, smartphones, mobile phones, digital cameras and camcorders, players, and other similar devices - all such equipment with built-in media is seized in its entirety.
Other types of equipment do not contain user-accessible computer media, so it is not necessary to seize or examine it. These include printers, scanners, fax machines, as well as keyboards, monitors, mice, joysticks, and speakers. It should be remembered that technology is rapidly evolving, and media accessible to the user may appear tomorrow as part of devices that do not have them today.
For example, in 2000, an audio player was not considered a computer media carrier, but today almost all audio players (MP3 players) are considered user portable drives. In the near future, manufacturers plan to equip all household appliances with built-in computers - refrigerators, air conditioners, coffee makers, washing machines, etc. A computer as part of household appliances will likely include a built-in or removable drive and a network interface for remote access.
So, let's start with the basic principles of handling information carriers and computer equipment during a search, and then describe in more detail the rules for conducting a search when such equipment is present.
Principles:
During the seizure of computer equipment, no information contained on the seized media should be altered. It is the responsibility of the investigation to prove that the computer information presented to the expert or the court has not been altered. Neither during the search nor during subsequent storage.
Access to information and its examination "on the spot" is permissible only in cases where it is impossible to seize the media and send it for examination. Such access should be carried out by a competent specialist who is able to understand and explain the meaning and consequences of their actions.
All actions with computer equipment must be documented so that an independent investigator can repeat them and obtain the same results.
General rules for seizing computer equipment during a search:
Take control of the premises where the equipment is installed, as well as the electrical panel. Do not allow anyone other than your specialist to touch the equipment and power devices. In extreme cases, if it is impossible to remove local personnel from the equipment, record all their actions. In those rare cases when there are grounds to believe that alert accomplices outside your control are aware of the search, disconnect the network connections of the computers as soon as possible. To do this, unplug the local network cables from the computers and disconnect the modems. In the few minutes it takes to photograph and prepare to turn off the equipment, an accomplice could potentially connect to the computer over the network and destroy significant information on it.
Do not turn on devices that are turned off.
Take a photo or video of the computer equipment. In extreme cases, you can draw a diagram. Pay attention to the cables - where each one is connected. It is also desirable to photograph the connection of the cables or label them for identification. All connected peripheral devices should be photographed and/or described in the protocol so that it is clear how everything was connected.
If the computer is turned on at the time of the search, take a photo or otherwise record the image on the monitor.
With a turned-on but "sleeping" computer, you can do two things: either turn it off immediately without touching it, as described below, or first activate it by moving the mouse slightly, photograph the contents of the screen, and then turn it off. The choice of option remains with the operation leader. When "waking up" or activating the computer, it may turn out that exiting the "sleep" mode or the screensaver* is password protected. In this case, the computer should be turned off using the method described below.
Find and collect sheets on which passwords, network addresses, and other data may be written - often such notes are found on the workstation, attached to the monitor, or hanging on the wall.
If the printer is printing something, wait for the printing to finish. Everything that is in the output tray of the printer is described and seized along with other computer media.
After that, the computers must be turned off. This must be done by a competent specialist. Do not allow local personnel or the owner of the seized equipment to do this, and do not accept their advice. If you do not have a specialist with you, turn off the desktop computer by unplugging the power cord from the computer case (not from the wall outlet). Turn off the laptop by unplugging the power cord and removing its battery without closing the lid.
Sometimes you can mistake a powered-on computer for a powered-off one. During hibernation, the screen goes dark, and some computer functions pause. LED lights may dim or change color. However, a powered-on computer, even in a "sleeping" state, always has a power indicator lit on the system unit. Conversely, all indicators on the system unit are off when the computer is powered off, although the monitor indicator may be lit. More details on shutting down can be found in the "How to Shut Down?" section of the "Short-lived Data" chapter.
Equipment is sealed to prevent both physical access to the case and power connection. This fact is reflected in the protocol.
Confiscated equipment is packed according to its fragility and sensitivity to external influences. Hard disk drives (HDDs) are particularly sensitive to vibration; mechanical damage (e.g., during transportation in the trunk) leads to complete data loss.
Interview all users for passwords. Try to learn all known passwords from each employee (more precisely, login-password pairs) related to the confiscated equipment. Passwords should not be perceived orally. They should be written down character by character, paying attention to the alphabet and case of each character, and verified with the source. Passwords can be written down on a piece of paper without being included in the interrogation protocol or explanation. Their probative value does not decrease from this.
Computer information related to the case and other digital traces of criminal activity may be contained in a variety of digital devices and media. During a search, try to identify all such devices and media, quickly determine if they may contain relevant information, and seize them if they may. The involvement of a specialist is required to detect such media or devices.
In case a specialist is not available, the following illustrations depict the most common devices capable of containing computer information. Below are recommendations for handling some types of computer equipment. They should be followed only in the absence of a technical specialist in your group. The specialist must know how to handle each specific model of equipment to preserve the information unchanged. In the presence of a specialist, follow his instructions.
Notebook (laptop, portable computer)
If the notebook is turned on at the start of the search, the first step is to photograph or otherwise document the contents of the screen, as mentioned above. To turn off the notebook, it is not enough to unplug the power cord; in this case, the notebook will switch to battery power. To disconnect power, the battery must be removed. At the same time, the notebook lid should not be closed or folded. When folded, the hibernation function is usually activated, which means changes are made to the information on the disk, violating the above principles. Handheld computer (PDA) This class includes: PDA, PDA (Personal Digital Assistant), palmtop, pocket PC, organizers, smartphones, communicators, electronic diaries [51, 84, 93]. The feature of this class of computers is that a significant part of user data is stored in them in RAM, energy-dependent memory. When power is turned off, all such information is irretrievably lost. The "off" state of the handheld actually means non-shutdown, but rather "sleep" or hibernation mode. In this case, electricity is only consumed to maintain RAM. In this state, it can be stored for several days, depending on the current state of the battery. If the handheld is turned on (active) at the start of the search, the first step is to photograph or otherwise document the contents of the screen, as mentioned above. When the screen is inactive, it automatically goes dark, and the handheld goes into hibernation mode after a few minutes. After taking the photo, you can manually turn it off with the "power" button, if available. Do not touch the handheld screen, as it is sensitive; each touch to the screen is perceived as a command. The battery cannot be removed from the handheld. Together with it, the cradle (stand with power and connection device) or another charging device must be removed. The handheld can be stored on its own, without charging, for a short time, usually a few days. The storage duration depends on the initial condition of the battery. After it is depleted, the contents of the RAM will be lost. It is better not to risk it and transfer the computer to an expert as soon as possible after removal. And before such a transfer, if possible, keep it inserted in the cradle so that the battery does not run out. A handheld can be stored in the cradle (which, of course, must be connected to the power grid) indefinitely. However, storing it in the cradle is incompatible with sealing the computer. The search (confiscation, personal search) protocol should include approximately the following: "During the inspection and confiscation of the handheld computer, its buttons were not pressed, the screen was not touched, the battery or removable media were not removed. The handheld computer in hibernation (sleep) mode was packed and sealed to prevent access to its control elements (buttons, screen)
Flash Drives
Flash memory drives are produced as standalone devices as well as part of other devices such as MP3 players or digital cameras. The shape and size of devices with flash drives are also quite diverse. Most often, these drives are equipped with a USB interface, which is how they can be recognized.
Such drives do not lose data when there is no power supply, so they can be stored for a long time. When removed, they should be sealed to prevent access to the USB port and control buttons (if any). It is possible to make a copy of a flash drive on the spot. How to do this is described in the section "Computer-technical examination." However, there is usually no need for such copying, as the flash drive is removed anyway when there are grounds to believe that it may contain significant information for the case. Then it is sent for examination. Making a copy on the spot is logical in cases when there is no time to wait for the results of the examination and you need to quickly get information to continue the investigation. In such cases, a specialist makes a copy of the drive on the spot, the drive itself is sealed, removed, and set aside for examination, while its copy is examined to obtain unofficial but urgent information.
Mobile Phones
Before considering the seized mobile phone as a carrier of computer information, it is necessary to decide whether it is necessary to obtain physical evidence from it - fingerprints, traces of drugs, and so on. It should be remembered that some methods of removing fingerprints can render the phone unusable. In most cases, when seized, the mobile phone should be turned off to prevent the loss of existing data due to incoming calls and SMS messages. The battery should not be removed. However, in some cases, the operation leader may decide that monitoring incoming calls is more important. In this case, the phone should be left on and charged as needed. A turned-off phone is packed in rigid packaging and sealed to prevent access to its control organs. This is noted in the protocol. When turning off the phone, there is no need to worry about the PIN code to access the data on the SIM card of the phone. The communication operator can provide the PUK (PIN unlock key) at any time, and with its help, access to the SIM card can be obtained. There is quite a lot of technical literature on field and laboratory research of information from mobile phones.
Modems
Some modems store user information - network settings or provider phone numbers. If there is no specialist who can indicate which specific model of modem is present here - with memory or without - then the modem should be disconnected from the power supply, sealed, and removed.
Tenevoy recommends - be more serious and study forensic science. Remember - on the other side of life's realities, there are professionally trained people. Yield to them in at least something - and they will devour you.