COLLECTION/ACQUISITION
Unlike other types of evidence, digital evidence requires an electrical power source to operate. Having said that, digital evidence may be lost or corrupted if power is not maintained. For cell phones, this becomes complicated because digital evidence can be overwritten or deleted remotely if the cell phone remains active. Software is available, and some phones come with it, that allows for rendering the phone unusable (a so-called “kill switch” which “bricks” the phone, disabling it so it is as useful as a masonry brick). To secure cell phones from this type of tampering, crime scene responders should have shielding material to block incoming or outgoing signals. This can be done by placing the phone in “airplane mode” to cut off cellular and wireless (wifi) signals. The easiest and cheapest way to do this is to wrap the cell phone in at least three layers of aluminum foil, like the kind used in home kitchens. Moving some digital devices while powered, like desktop computers, may dam age the device or any mechanical storage media (hard drives, for example). If it is necessary to move a device during collection and documentation (to find and record a serial number, for example), the device should be hibernated or powered off first. Modern operating systems have the ability to hibernate to disk. It may be prudent to preserve volatile data by hibernating to disk instead of powering off the device. This may potentially overwrite deleted data, however; this is a critical decision that needs to weigh in the crime type and the types of evidence that hold the most proba tive value. Record any network and wireless access points that may be present and capable of linking computers and other devices to each other and the Internet. The existence of network and wireless access points may indicate that additional evi dence exists beyond the initial scene. If multiple computers and devices are to be col lected, all devices, cables, and connections should be labeled clearly and individually (Figure 1). For example, identify the first computer seized as “Computer A” or “Device #1” and then each cable and connection, including photographs. Subsequent computers can be labeled alphabetically or numerically. Digital evidence is sensitive to extreme temperatures, humidity, physical shock, static electricity, and magnetic fields. Digital evidence should be packaged to prevent bending, scratching, damage, or other physical hazards. Leave cell phones in the power state (on or off) in which they were found. Importantly, remember to collect all power supplies and adapters for all digital devices seized; they will be needed eventually. Peripherals or system components, like keyboards, mice, removable storage media, and printers may have other types of evidence on them, fingerprints or DNA, for example, and these objects must be handled in a way that does not contaminate or damage this nondigital evidence.
FIGURE 1 Steganography is the practice of hiding one message inside of another; digital media make this particularly difficult to detect and analyze. The image of the cat is hidden in the image of the tree by removing all, but the two least significant bits of each color component and then normalizing the image.
