From Alternate Data Storage Forensics

Other Options for Seizing Digital Evidence

The wholesale seizure of the physical storage device/media is arguably the most common form of seizure practiced by law enforcement responders today. The question remains, are there other options besides the seizure of physical devices that are available to responders? If yes, are these methods of seizure within the reach of anyone but the most technical of responders?

For a long time, up to and including today, many in the forensics community place little faith in the ability for responders on-scene to deal appropriately with the computers they may encountcr. The direction was simply Don t touch the keyboard. Pull the plug and send everything to the lab. In many cases, the forensics side of the house is correct to protect against the possible corruption or destruction of data by taking this hard-line approach particularly based on the technology of yesterday but at what cost? Although the computer forensics community might have intended to do the most good by promulgating the pull-the-plug mantra, we need to examine how disempowering the on-scene responders may affect the overall forensic process, from seizure through analysis to investigation and ultimately prosecution.

The latest Search and Seizure of Computers and Obtaining Digital Evidence (Manual), published by the Department of Justice supports the proposition that the seizure of digital evidence should be an incremental process, based both on the situation and the training level of the responder. The Manual describes an incremental approach as a search strategy (pg. 221) for the seizure...

Copyright Elsevier Inc. 2007 under license agreement with Books24x7

Products & Services
Positive Displacement Valves
Positive displacement valves are precision dispensing devices designed to provide precise fluid dispensation depending on applications. They function by opening quickly, releasing product, and closing again.
Data Recovery Services
Data recovery services enable the retrieval of inaccessible or contaminated data from a secondary storage media that has been damaged.
Personal Alert Safety Systems (PASS)
Personal alert safety systems (PASS) are devices used by emergency responders to indicate distress or a need for assitance in extreme environments. These systems use features such as strobe lights, audible alarms, and radio communications to help locate devices and personel in the field.
Pivot Bearings
Pivot bearings are used for pivotal, angular, or oscillating applications.

Topics of Interest

Common Threads within Digital Evidence Seizure The landscape of potential seizure environments is complicated and variations are nearly infinite. The level of knowledge of the on-scene responders...

Other Options for Seizing Digital Evidence The wholesale seizure of the physical storage device/media is arguably the most common form of seizure practiced by law enforcement responders today. The...

Solutions Fast Track Defining Digital Evidence The term data objects is used in this chapter to refer to discrete arrangements of digital information logically organized into something meaningful.

Summary There is no doubt that the investigators of tomorrow will be faced with more digital information present in greater numbers and types of devices. Seizing the relevant evidentiary information...

Summary There is no doubt that the investigators of tomorrow will be faced with more digital information present in greater numbers and types of devices. Seizing the relevant evidentiary information...

Product Announcements
Shimadzu Scientific Instruments, Inc.
Shimadzu Scientific Instruments, Inc.