Evidence in Multi-computer Crime Scene
When processing a crime scene that contains cyber evidence, there are three main categories of evidence. Areas to be searched may be obvious, such as a desk with a computer on it or drawers containing computer-related material. Other areas, such as suspended ceilings and adjacent rooms may also be important. Local Area Networks (LANS) will often connect multiple computers, tablets, and smartphones to each other. In addition, either intentionally or for functional aesthetics, devices supporting connections and even power backup may be concealed in suspended ceilings, behind panels, or in adjacent rooms/closets.
Research and identify the following types of evidence that may be found in a multi-computer crime scene and that should be seized:
- Category 1: Remember that hardware means a physical device that computes, stores virtual files, scans, or prints.
- Category 2: Software may be in various forms and contains programs that can be loaded onto computer hardware to perform functions. Software by itself cannot do anything.
- Category 3: The lab needs to set up the computer-seized items using the same materials brought from the crime scene in the same configuration. This includes power sources, connection cables, and wireless connection devices.
List 3 items of evidence from each category, and briefly identify their function.
Category 1: Hardware
- Computer Tower: The central processing unit (CPU) of a computer system that contains the hardware necessary to process data and execute programs.
- External Hard Drive: A portable storage device that can be connected to a computer to store large amounts of data externally.
- Network Router: A hardware device that connects multiple computers in a Local Area Network (LAN) and enables communication between them and the internet.
Category 2: Software
- Operating System: Software that manages computer hardware and software resources, providing a user interface and enabling the execution of applications.
- Forensic Imaging Software: Specialized software used to create a forensic image or an exact copy of a storage device for analysis and preservation of data.
- Encryption Software: Programs designed to encode and protect data by converting it into unreadable ciphertext, often used to secure sensitive information.
Category 3: Computer-Seized Items Setup
- Power Strip: A device that provides multiple electrical outlets from a single power source, allowing multiple devices to be connected to the same power supply.
- Ethernet Cables: Cables used to establish a wired connection between computers, routers, and other networking devices.
- Wireless Network Adapter: A device that enables computers to connect to a wireless network by receiving and transmitting wireless signals, allowing for wireless communication between devices.
It is important to note that the specific items of evidence and their functions may vary depending on the nature of the crime scene and the type of cybercrime being investigated. The examples provided here are common items that can be encountered in a multi-computer crime scene, but there may be additional hardware, software, or setup components that are relevant in specific cases.
