How do I identify and preserve the crime scene or crime scenes in computer crime incidents?

Computer crime scenes vary from case to case. The investigator needs to assess the type of crime and the potential for evidence related to the crime. The investigator can then determine what is important to the case and what evidence needs to be collected. At the scene of an incident involving computers the obvious items of interest are the computers, the peripherals and any storage media.

Preserving the crime scene involves ensuring that evidence is not altered or lost. In the area of digital evidence, the National Institute of Justice (NIJ) has produced a guide for First Responders. This document provides investigators with a guide to the computer crime scene. The NIJ guide can be found at www.ojp.usdoj.gov/nij/pubs-sum/219941.htm.