Welcome back to the computer forensics path, course six, module five.
We're going to talk about the transportation and
storage of digital evidence.
Transportation of evidence if possible, we want to use the original packing material.
This will keep the item safe and securely packed.
We want to use padding if available.
If the original packaging is not available,
we want to make sure we pack the item as securely as possible to limit movement.
You definitely want to keep digital evidence away from extreme heat or cold.
Don't put it in the trunk of your car on a summer day.
You want to keep it away from magnetic sources because that can alter or
destroy your evidence.
Some of the things we have to consider when we're doing transportation of
evidence, is large items.
If we have an item that is too large for standard transportation,
you're going to have to make arrangements and
have a plan to transport that large item, too large to fit in a regular vehicle.
We may have to rent or borrow a larger vehicle.
We may have other moving items.
We have to consider the weather.
If we're putting stuff in the back of a pickup truck,
we want to make sure we know if it's going to rain that day or not.
Time restrictions, if we borrowed or rented a vehicle,
there are going to be some type of time restrictions.
And when I say other moving items, if you're moving an extremely large item,
you may need a dolly or some type of item, a cart, these are all things we
need to consider when we're making arrangements for large items.
Storage of evidence, you want to make sure you store your evidence in a secure
location, and that secure location needs to be access controlled.
Whether it's a log, whether you have a camera system or you have a key card
entry system that is logged, you need to make sure it's access controlled.
It also needs to be climate controlled,
because digital evidence needs to stay at a certain temperature.
You don't want it too hot, you don't want it too cold, you don't want it wet or
overly moisture there.
And we need to document the chain of custody and
I know we've mentioned it before, but it bears mentioning again.
You need to document every time evidence is checked in and out.
You need to document who had control over that evidence.
We need to include date and time that the evidence is checked in and out.
And we need to account for the evidence at all times.
You can't have a block of time where the evidence is unaccounted for.
We're sitting on somebody's desk, on somebody's locker, or
in a desk drawer, that is bad.
That is going to hurt you down the road.
This concludes course six.
In course seven, we are going to cover the triage and
preservation of digital evidence.