Electronic Crime Scene Investigation Summary

This report is to give a brief, but an informative report of the chapters in the book Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition. The chapters that will be focused on are chapter one which talks about different types of potential evidence that can be found in devices that store information. The next chapter that will be looked at is chapter three which details how and what to do when securing and evaluating evidence. Following this the chapter with will be looked at is chapter four which is focused on documenting the electronic crime scene and how it should be done to cover all bases. Finally, the final chapter that will be looked at is chapter five which looks at evidence collection and how to do it

The chapter begins with talking about computer systems and its different types such as PCs, Macs, and laptops and that they have the potential of having valuable information for an investigation this can include photos, emails, financial records, event logs, and other information that will be useful for an investigation. After this, the chapter continues to talks about different kind of storage devices such as hard drives which can be found inside a computer, external hard drives which are found outside a computer, and this also includes removable media such as different kinds of disks, thumb drives, and memory cards. Like computer systems, these storage devices have great potencies in providing valuable information for an investigation. Following this, the chapter talks about handheld devices and it potentiation for providing important information such as contact information, GPS data, and internet and chat information that will be useful for an investigation. The chapter after this then talks about peripheral

In this chapter, it begins by warning that if an encrypted device is shut off improperly the data will become unacceptable. After this warning the chapter talks about a variety of situations to see if the computer is on, the two main points that come from this section are to document any activity done on the computer or any devices and to check the power state of the computer to make sure when it is moved it is not on. Later the chapter gives instructions on what to do when the computer is turned off these include steps like photographing and documents all wires, cables, and devices connected to the computer. As well as this the steps that must be followed are to label everything that is relevant to the investigation and photograph it as well. After this doesn't the steps are to carefully disconnect and secure anything that is needed for their invitation and to record any important information such as make, model, serial numbers. Then finally to record and log all the evidence that is being taken and follow procedures to make sure everything is done by the book. Following this, the chapter talks about if a laptop is involved these steps are pretty much identical to the previous steps. The chapter continues to state that if the computer is found