EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition

Handling Evidence at the Scene

In this section, I’ll cover the various aspects of handling evidence at the scene. I’ll begin with securing the scene. Once the scene is secured, you need to document everything in place. After documenting the scene, the next step is that of seizing various items, namely, computers. Before computers can be seized, they typically have to be shut down. I’ll discuss the various issues associated with operating systems and system function as they relate to shutting down various systems. I’ll end the discussion with the bagging-and-tagging process, transporting, and securing, all in support of the all-important chain of custody. Let’s get started!

Securing the Scene

When you arrive at the scene, safety is the number-one ...