Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition

This guide is intended to assist State and local law enforce­ ment and other first responders who may be responsible for preserving an electronic crime scene and for recognizing, col­lecting, and safeguarding digital evidence. It is not all inclusive but addresses situations encountered with electronic crime 
scenes and digital evidence. All crime scenes are unique and the judgment of the first responder, agency protocols, and prevailing technology should all be considered when imple­menting the information in this guide. First responders to electronic crime scenes should adjust their practices as cir­cumstances—including level of experience, conditions, and available equipment—warrant. The circumstances of individual crime scenes and Federal, State, and local laws may dictate actions or a particular order of actions other than those described in this guide. First responders should be familiar with all the information in this guide and perform their duties and responsibilities as circumstances dictate. 
When dealing with digital evidence, general forensic and procedural principles should be applied: 
■ The process of collecting, securing, and transporting digital evidence should not change the evidence. 
■ Digital evidence should be examined only by those trained specifically for that purpose. 
■ Everything done during the seizure, transportation, and storage of digital evidence should be fully documented, preserved, and available for review.