Cryptosmith

While it’s interesting in theory to see the basic Electronic Crime Scene Investigation Handbook cited in Bruce Schneier’s blog, the only interesting content was in the protocols to decide whether or not to turn a computer off.

Once the “potential evidence” computers are turned off, you note where all the wires go, photograph and document all connections, and then unplug and pack everything up. Then it’s up to the smart guys back at Headquarters to puzzle everything out.

If there’s a question of whether computers should be turned off (i.e. there is evidence displayed on the screen of one that’s on) then they leave it on and call in more experts.

Posted under Information Security |