Digital Evidence
This device often contains messages, photos, call logs, and location history.
What is a smartphone?
What is the first priority at any crime scene?
What is ensuring safety of everyone present
This document gives investigators legal authority to search and seize evidence.
What is a search warrant?
Scenario: You arrive at a burglary. A laptop is sitting open on a desk.
What should you do before moving it?
Photograph and document the laptop, including whether it is on or off and anything displayed on the screen.
A suspect sends repeated threatening messages through social media. What type of crime is this?
What is cyberstalking or online harassment?
Name two removable storage devices that should be collected as digital evidence.
What are USB flash drives, SD cards, external hard drives, CDs/DVDs (any two)?
Before collecting evidence, investigators should first do this to preserve the scene.
What is photograph/document the scene?
This process documents who has handled evidence from collection to court.
What is chain of custody?
Scenario: During a search, you find a USB flash drive taped underneath a desk.
What should you do?
Photograph it in place, document its location, collect it as evidence, package it properly, and maintain chain of custody.
An attacker tricks someone into revealing their password by pretending to be their bank in an email. What is this attack called?
What is phishing?
True or False: A powered-off laptop has no evidentiary value.
What is False
Electronic devices should generally be handled as little as possible to prevent what?
What is altering or destroying evidence?
True or False: Every person who handles evidence should be documented.
What is true?
Scenario: While searching a suspect's bedroom, another officer says, "We already got the laptop. We don't need the gaming console."
What is the correct response?
Collect the gaming console because it may contain digital evidence such as messages, internet history, user accounts, or stored files.
Someone gains unauthorized access to another person's computer without permission. What crime has likely been committed?
What is unauthorized computer access (computer hacking)?
Besides computers and phones, give two other smart devices that may contain evidence.
What is Smart watches, smart speakers, security cameras, gaming consoles, smart TVs, GPS units, routers, etc.
Why is it important to document where every electronic device was found?
What is because its location may help establish ownership, use, or relationships to other evidence.
Why should evidence bags be sealed and labeled immediately?
What is to preserve integrity and identify the evidence.
Scenario: Officers locate a powered-on smartphone receiving notifications.
What should investigators do to help preserve the evidence?
Document the device's condition, then isolate it from networks (such as with a Faraday bag or airplane mode if appropriate under agency procedures) to reduce the risk of remote changes while preserving evidence.
A victim reports their online banking account was emptied after clicking a fake login page. What type of crime is being investigated?
What is identity theft?
A suspect's desk contains a laptop, smartphone, USB flash drive, smartwatch, and an external hard drive. Which item would NOT typically be considered digital evidence?
What is none of them?
Give three items that should be documented before moving a computer.
Any 3 of the following:
If an officer exceeds the scope of a search warrant, what may happen to the evidence?
What is it may become inadmissible in court.
Scenario: Officers execute a search warrant at a suspected identity theft operation. They find: Two laptops, three smartphones, a Wi-Fi router, several USB drives, a notebook, and an external hard drive
Which items should be collected as evidence?
What is all of them
Officers arrive at a home after a report of online child exploitation. Besides computers and phones, name three additional items that could contain relevant digital evidence.
Any three: USB flash drives, SD cards, external hard drives, tablets, gaming consoles, Wi-Fi router, DVR/security cameras, cloud storage credentials, smartwatch