Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
High Tech Evidence Collection and Seizure <ul><li>Detective Gregory Dawson </li></ul><ul><li>Pierce Co. Sheriff’s Dept. </...
Pierce County Regional Computer Laboratory <ul><li>Detective Gregory Dawson </li></ul><ul><li>Work Ph. (253)798-7508 </li>...
Class goals <ul><li>FAMILIARIZE  attending LEO’s with the process of collecting a computer and associated evidence in a sa...
High Tech Evidence Collection and Seizure <ul><li>Identification </li></ul><ul><ul><li>Types of computer related evidence ...
High Tech Evidence Collection and Seizure <ul><li>Identification </li></ul><ul><li>Preservation and Collection </li></ul><...
High Tech Evidence Collection and Seizure <ul><li>Identification </li></ul><ul><ul><li>General Concepts </li></ul></ul><ul...
Identification   General Concepts <ul><li>Consider all items real and virtual which could be evidence </li></ul><ul><li>Mu...
Identification   General Concepts <ul><li>What to Take: </li></ul><ul><li>If you are seizing computer equipment, you may w...
Identification   General Concepts <ul><li>What to Take: </li></ul><ul><li>You may only want to take data  </li></ul><ul><u...
Identification   General Concepts <ul><li>If you are only going to take data, (i.e., image the computer media on scene) </...
Identification   Types of Computer Related Evidence <ul><li>Computer paraphernalia </li></ul><ul><ul><li>Printers and othe...
Identification   Types of Computer Related Evidence <ul><li>Computer paraphernalia </li></ul><ul><ul><li>Computers, keyboa...
Identification   Types of Computer Related Evidence <ul><li>Paper output  </li></ul><ul><ul><li>Ledgers </li></ul></ul><ul...
Identification   Where and how computer related evidence may be found <ul><li>Desktops </li></ul><ul><li>Monitors </li></u...
Identification   Where and how computer related evidence may be found <ul><li>Garbage cans </li></ul><ul><li>Under keyboar...
Identification   Where and how computer related evidence may be found <ul><li>Search limited by the location described in ...
Identification   Where and how computer related evidence may be found <ul><li>Search the Area Carefully </li></ul><ul><ul>...
Computer Case – Tower Configuration
Monitor, Keyboard, and Mouse
Computer Media/Storage
Computer Media/Storage USB pocket disk 32MB  IBM Microdrive 1GB, 500/340 MB
Computer Media/Storage “ Thumb Drives” up to 128MB “Disk-on-Key” unit
Card Readers USB Pocket DigiDrive.  Reads multiple media sources, smart cards etc..
Magnetic Readers Mini-Mag Magstripe reader (PMR 102), is ideal for capture and storage of magnetic stripe data without the...
Computer peripherals
Flat Plate Scanner
Computer Cases
Computer Cases
Sometimes they can never be separated from their computer
High Tech Evidence Collection and Seizure <ul><li>Preservation and Collection </li></ul><ul><ul><li>Preservation </li></ul...
Preservation and Collection    Preservation <ul><li>Have a plan for proper packaging and transport… </li></ul><ul><li>Pre-...
Preservation and Collection    Preservation <ul><li>Determine if the evidence can be collected and preserved for future an...
Preservation and Collection    Preservation <ul><li>Document everything </li></ul><ul><li>Practice safe evidence handling ...
Preservation and Collection    Preservation <ul><li>Fragility of computer evidence </li></ul><ul><ul><li>It tends to be ve...
Preservation and Collection    Preservation <ul><li>Avoid magnetic fields </li></ul><ul><li>Avoid excessive heat </li></ul...
Preservation and Collection    Preservation <ul><li>Static electricity </li></ul><ul><ul><li>Avoid touching exposed wires ...
Preservation and Collection    Preservation <ul><li>Do use paper bags or cardboard boxes </li></ul><ul><li>Do use original...
Preservation and Collection    Preservation <ul><ul><li>It is advisable that only investigators with sufficient knowledge ...
Preservation and Collection    Preservation <ul><li>However, it is paramount in specialized instances such as </li></ul><u...
Preservation and Collection    Preservation <ul><ul><li>Hacker systems </li></ul></ul><ul><ul><li>Note: </li></ul></ul><ul...
Preservation and Collection    Preservation <ul><li>Basic Rules. </li></ul><ul><ul><ul><ul><li>Don’t let the suspect near ...
Preservation and Collection    Preservation <ul><li>Photograph and document everything </li></ul><ul><li>Rule to remember:...
Preservation and Collection    Preservation <ul><li>Is the computer on or off? </li></ul><ul><li>If the computer is on, wh...
Preservation and Collection    Preservation <ul><li>For example:  running windows, running applications, or maybe even ove...
Preservation and Collection    Preservation <ul><li>Assess the type of operating system if possible.  This will influence ...
Preservation and Collection    Preservation <ul><li>Assess the potential for loss of data from outside threats such as wea...
Preservation and Collection    Preservation <ul><li>Consider the previous conditions to determine if the computer should b...
Preservation and Collection    Preservation <ul><li>Be prepared for “Emergency” shut-down </li></ul><ul><ul><li>Have a cam...
Preservation and Collection    Preservation <ul><li>A little “Urban Legend” </li></ul><ul><ul><li>Magnets and Degaussing E...
High Tech Evidence Collection and Seizure <ul><li>Preservation and Collection </li></ul><ul><ul><li>Preservation </li></ul...
Preservation and Collection    Collection <ul><li>List the date, time and description of the computer </li></ul><ul><li>Li...
Preservation and Collection    Collection <ul><li>List the date, time and action taken </li></ul><ul><li>Record your inves...
Preservation and Collection  Collection <ul><li>Photograph the computer using 35mm, polaroid, digital and/or video camera ...
Preservation and Collection  Collection <ul><li>Photograph cables </li></ul><ul><li>Disconnect power to the system, at the...
Preservation and Collection  Collection <ul><li>Photograph attached hardware </li></ul><ul><li>Take pictures of anything t...
Preservation and Collection  Collection <ul><li>Sometimes the “Devil is in the details”… </li></ul>
It is the small stuff that can create problems sometimes…
Preservation and Collection  Collection <ul><li>Be sure to note “unusual” things about the condition of the evidence…. </l...
Someone wanted this one dead…
Preservation and Collection  Collection <ul><li>Mark and tag all cables and hardware </li></ul><ul><li>Use wire tags and s...
Preservation and Collection  Collection <ul><li>If you are seizing more than one computer system first number the computer...
Preservation and Collection  Collection <ul><li>Prepare the computer for transport </li></ul>
Preservation and Collection  Collection <ul><li>Package the computer, cables and other hardware in boxes after entering th...
Preservation and Collection  Collection <ul><li>Seizing floppies and other removable media </li></ul><ul><li>Count floppie...
Preservation and Collection  Collection <ul><li>Mark them using an indelible colored marker or labels on tape or other sti...
Preservation and Collection  Collection <ul><li>Keep magnetic media separate from other seized items. This will aid you la...
Preservation and Collection  Collection <ul><li>Place seized diskettes in separate boxes for each room </li></ul><ul><li>I...
Preservation and Collection  Collection <ul><li>Transportation of Evidence: </li></ul><ul><li>Pack the transport vehicle w...
Preservation and Collection  Collection <ul><li>Transportation of Evidence: </li></ul><ul><li>Items fall out of pickups an...
Preservation and Collection  Summary <ul><li>Package properly </li></ul><ul><li>Handle carefully </li></ul><ul><li>Mark cl...
High Tech Evidence Collection and Seizure <ul><li>Preservation and Collection </li></ul><ul><ul><li>Preservation </li></ul...
Preservation and Collection    Physical chain of evidence <ul><li>The “Chain of Evidence” is the: </li></ul><ul><li>Docume...
Preservation and Collection    Physical chain of evidence <ul><li>Maintain the “Chain of Evidence” </li></ul><ul><li>Evide...
Preservation and Collection    Physical chain of evidence <ul><li>“ Chain of Evidence” presentation: </li></ul><ul><li>Doc...
Preservation and Collection    Physical chain of evidence <ul><li>“ Chain of Evidence” presentation: </li></ul><ul><li>Run...
Preservation and Collection    Physical chain of evidence <ul><li>Documentation of the “Chain of Evidence”: </li></ul><ul>...
High Tech Evidence Collection and Seizure <ul><li>Storage Guide </li></ul>
High Tech Evidence Storage <ul><li>Secure area </li></ul><ul><li>Moderate temperature </li></ul><ul><li>Free of excessive ...
High Tech Evidence Storage <ul><li>Storage containers </li></ul><ul><ul><li>Original packaging =  the best material </li><...
Questions ???
Pierce County Regional Computer Laboratory <ul><li>Detective Gregory Dawson </li></ul><ul><li>Work Ph. (253)798-7508 </li>...
 
Upcoming SlideShare
Loading in …5
×

Evidence Seizure Ctin Version Draft Sent To Sandy For Polishing

644 views

Published on

Published in: Technology, Business
  • Be the first to comment

  • Be the first to like this

Evidence Seizure Ctin Version Draft Sent To Sandy For Polishing

  1. 1. High Tech Evidence Collection and Seizure <ul><li>Detective Gregory Dawson </li></ul><ul><li>Pierce Co. Sheriff’s Dept. </li></ul>February 1st, 2003
  2. 2. Pierce County Regional Computer Laboratory <ul><li>Detective Gregory Dawson </li></ul><ul><li>Work Ph. (253)798-7508 </li></ul><ul><li>Pager (253)680-1104 </li></ul><ul><li>Email [email_address] </li></ul><ul><li>If you have questions or need help please call!! </li></ul>
  3. 3. Class goals <ul><li>FAMILIARIZE attending LEO’s with the process of collecting a computer and associated evidence in a safe and effective manner. </li></ul><ul><li>Discuss good evidence handling PRACTICES </li></ul>
  4. 4. High Tech Evidence Collection and Seizure <ul><li>Identification </li></ul><ul><ul><li>Types of computer related evidence </li></ul></ul><ul><ul><li>Where and how computer related evidence may be found </li></ul></ul><ul><li>Preservation and Collection </li></ul><ul><ul><li>Preservation </li></ul></ul><ul><ul><li>Collection </li></ul></ul><ul><ul><li>Physical chain of evidence </li></ul></ul><ul><li>Presentation </li></ul><ul><ul><li>In court </li></ul></ul><ul><li>Storage guides </li></ul>
  5. 5. High Tech Evidence Collection and Seizure <ul><li>Identification </li></ul><ul><li>Preservation and Collection </li></ul><ul><li>Storage guide </li></ul>
  6. 6. High Tech Evidence Collection and Seizure <ul><li>Identification </li></ul><ul><ul><li>General Concepts </li></ul></ul><ul><ul><li>Types of computer related evidence </li></ul></ul><ul><ul><li>Where and how computer related evidence may be found </li></ul></ul>
  7. 7. Identification General Concepts <ul><li>Consider all items real and virtual which could be evidence </li></ul><ul><li>Must be described in the SW or articulated at the time of seizure </li></ul><ul><li>Often determined by the “type” of crime </li></ul><ul><li>Sophistication of suspect </li></ul>
  8. 8. Identification General Concepts <ul><li>What to Take: </li></ul><ul><li>If you are seizing computer equipment, you may want to take everything, subject to S/W specificity </li></ul>
  9. 9. Identification General Concepts <ul><li>What to Take: </li></ul><ul><li>You may only want to take data </li></ul><ul><ul><li>But…if you leave computer equipment, hardware, software or manuals and you may need it later in your investigation </li></ul></ul><ul><ul><li>Also, after you leave, the equipment may disappear altogether </li></ul></ul>
  10. 10. Identification General Concepts <ul><li>If you are only going to take data, (i.e., image the computer media on scene) </li></ul><ul><ul><li>you will have to have the equipment and personnel with you to do it </li></ul></ul><ul><ul><li>You will have to secure the scene long enough to do it </li></ul></ul>
  11. 11. Identification Types of Computer Related Evidence <ul><li>Computer paraphernalia </li></ul><ul><ul><li>Printers and other hardcopy hardware </li></ul></ul><ul><ul><li>Mouse, cables and other connectors </li></ul></ul><ul><ul><li>Software and manuals </li></ul></ul><ul><ul><li>Jaz and Zip drives </li></ul></ul><ul><ul><li>Tape backup drives </li></ul></ul><ul><ul><li>Hand and flat-plate scanners </li></ul></ul>
  12. 12. Identification Types of Computer Related Evidence <ul><li>Computer paraphernalia </li></ul><ul><ul><li>Computers, keyboards and monitors </li></ul></ul><ul><ul><li>Disks and diskettes </li></ul></ul><ul><ul><li>Magnetic tape storage units </li></ul></ul><ul><ul><li>Phones (memory dialers) </li></ul></ul><ul><ul><li>Circuit boards and components </li></ul></ul><ul><ul><li>Modems </li></ul></ul>
  13. 13. Identification Types of Computer Related Evidence <ul><li>Paper output </li></ul><ul><ul><li>Ledgers </li></ul></ul><ul><ul><li>Address books </li></ul></ul><ul><ul><li>Correspondence </li></ul></ul><ul><ul><li>Diary </li></ul></ul><ul><ul><li>Hacker notes </li></ul></ul>
  14. 14. Identification Where and how computer related evidence may be found <ul><li>Desktops </li></ul><ul><li>Monitors </li></ul><ul><li>Next to phones </li></ul><ul><li>In wallet </li></ul><ul><li>In suspects pocket </li></ul>
  15. 15. Identification Where and how computer related evidence may be found <ul><li>Garbage cans </li></ul><ul><li>Under keyboards </li></ul><ul><li>Dependent only on the size of item being searched for </li></ul><ul><li>Restricted only by the imagination of suspect </li></ul><ul><li>Look for evidence of computer use </li></ul>
  16. 16. Identification Where and how computer related evidence may be found <ul><li>Search limited by the location described in warrant </li></ul><ul><li>Search limited by the size of smallest item listed in warrant </li></ul>
  17. 17. Identification Where and how computer related evidence may be found <ul><li>Search the Area Carefully </li></ul><ul><ul><li>Don’t get “tunnel vision” on the area where a computer might be sitting </li></ul></ul><ul><li>Diskettes and small media hide themselves in the strangest places </li></ul><ul><li>We often find them inside books, taped to the bottom of keyboards, in chests of drawers, shirt pockets and other surprising places </li></ul>
  18. 18. Computer Case – Tower Configuration
  19. 19. Monitor, Keyboard, and Mouse
  20. 20. Computer Media/Storage
  21. 21. Computer Media/Storage USB pocket disk 32MB IBM Microdrive 1GB, 500/340 MB
  22. 22. Computer Media/Storage “ Thumb Drives” up to 128MB “Disk-on-Key” unit
  23. 23. Card Readers USB Pocket DigiDrive. Reads multiple media sources, smart cards etc..
  24. 24. Magnetic Readers Mini-Mag Magstripe reader (PMR 102), is ideal for capture and storage of magnetic stripe data without the presence of a computer or external power supply. Lithium battery for 5000 swipes. Non-volitile. Password protected.
  25. 25. Computer peripherals
  26. 26. Flat Plate Scanner
  27. 27. Computer Cases
  28. 28. Computer Cases
  29. 29. Sometimes they can never be separated from their computer
  30. 30. High Tech Evidence Collection and Seizure <ul><li>Preservation and Collection </li></ul><ul><ul><li>Preservation </li></ul></ul><ul><ul><li>Collection </li></ul></ul><ul><ul><li>Physical chain of evidence </li></ul></ul>
  31. 31. Preservation and Collection Preservation <ul><li>Have a plan for proper packaging and transport… </li></ul><ul><li>Pre-prepared “Evidence Kit” </li></ul>
  32. 32. Preservation and Collection Preservation <ul><li>Determine if the evidence can be collected and preserved for future analyses </li></ul><ul><li>Keep “chain of evidence” in mind </li></ul>
  33. 33. Preservation and Collection Preservation <ul><li>Document everything </li></ul><ul><li>Practice safe evidence handling - wear rubber gloves! </li></ul><ul><ul><li>Don’t let your prints be the only ones found </li></ul></ul><ul><ul><li>Bio-Hazards </li></ul></ul>
  34. 34. Preservation and Collection Preservation <ul><li>Fragility of computer evidence </li></ul><ul><ul><li>It tends to be very volatile and can easily be damaged or destroyed. Handle it with extra care. </li></ul></ul><ul><ul><li>Follow documented procedures for preserving computer and electronic evidence if your agency/organization has them canonized </li></ul></ul>
  35. 35. Preservation and Collection Preservation <ul><li>Avoid magnetic fields </li></ul><ul><li>Avoid excessive heat </li></ul><ul><li>Avoid direct sunlight </li></ul><ul><li>Don’t touch magnetic media with your skin </li></ul>
  36. 36. Preservation and Collection Preservation <ul><li>Static electricity </li></ul><ul><ul><li>Avoid touching exposed wires or circuit boards </li></ul></ul><ul><ul><li>DO NOT place items in plastic evidence bags </li></ul></ul><ul><ul><li>DO NOT place items in boxes of foam peanuts </li></ul></ul>
  37. 37. Preservation and Collection Preservation <ul><li>Do use paper bags or cardboard boxes </li></ul><ul><li>Do use original packaging material </li></ul>
  38. 38. Preservation and Collection Preservation <ul><ul><li>It is advisable that only investigators with sufficient knowledge and hands-on computer experience deal with computers, peripherals, diskettes, programs, etc., As well as with other technical or specialized equipment during searches </li></ul></ul>
  39. 39. Preservation and Collection Preservation <ul><li>However, it is paramount in specialized instances such as </li></ul><ul><li>Mainframes </li></ul><ul><li>Networked Computer Systems </li></ul><ul><li>Specialty computers </li></ul>
  40. 40. Preservation and Collection Preservation <ul><ul><li>Hacker systems </li></ul></ul><ul><ul><li>Note: </li></ul></ul><ul><ul><ul><li>When you have a case involving a computer as the object or means of committing a crime, remember that a program running in memory might be the evidence of your crime </li></ul></ul></ul>
  41. 41. Preservation and Collection Preservation <ul><li>Basic Rules. </li></ul><ul><ul><ul><ul><li>Don’t let the suspect near the machine. </li></ul></ul></ul></ul><ul><ul><ul><ul><li>Don’t let cops or “computer experts” play with the computers to “see what’s inside.” </li></ul></ul></ul></ul><ul><ul><li>Both can be equally destructive. </li></ul></ul>
  42. 42. Preservation and Collection Preservation <ul><li>Photograph and document everything </li></ul><ul><li>Rule to remember: if you’re comfortable the computer is comfortable </li></ul>
  43. 43. Preservation and Collection Preservation <ul><li>Is the computer on or off? </li></ul><ul><li>If the computer is on, what is the computer doing? </li></ul><ul><li>If a computer is on, there is a good chance it is doing something </li></ul><ul><li>Evaluate the Condition of the Computer: </li></ul>
  44. 44. Preservation and Collection Preservation <ul><li>For example: running windows, running applications, or maybe even overwriting or destroying data which might be evidentiary </li></ul><ul><li>Evaluate the Condition of the Computer: </li></ul>
  45. 45. Preservation and Collection Preservation <ul><li>Assess the type of operating system if possible. This will influence how you might preserve and collect the evidence </li></ul><ul><li>Evaluate the Condition of the Computer: </li></ul>
  46. 46. Preservation and Collection Preservation <ul><li>Assess the potential for loss of data from outside threats such as weather, electrical and magnetic conditions </li></ul><ul><li>Determine if the computer is connected to other computers by network or modem </li></ul><ul><li>Evaluate the Condition of the Computer: </li></ul>
  47. 47. Preservation and Collection Preservation <ul><li>Consider the previous conditions to determine if the computer should be turned off or left running for a period of time and photograph the screen with a video camera </li></ul><ul><li>Evaluate the Condition of the Computer: </li></ul>
  48. 48. Preservation and Collection Preservation <ul><li>Be prepared for “Emergency” shut-down </li></ul><ul><ul><li>Have a camera ready </li></ul></ul><ul><li>Evaluate the Condition of the Computer: </li></ul>
  49. 49. Preservation and Collection Preservation <ul><li>A little “Urban Legend” </li></ul><ul><ul><li>Magnets and Degaussing Equipment. </li></ul></ul><ul><li>The possible presence of degaussing (magnets) equipment placed in the crime scene by the suspect </li></ul><ul><ul><li>Evidence being lost due the presence of large degaussing hardware hidden in a doorway and operated by a wall switch </li></ul></ul><ul><ul><ul><li>Hmm,…not likely </li></ul></ul></ul>
  50. 50. High Tech Evidence Collection and Seizure <ul><li>Preservation and Collection </li></ul><ul><ul><li>Preservation </li></ul></ul><ul><ul><li>Collection </li></ul></ul><ul><ul><li>Physical chain of evidence </li></ul></ul>
  51. 51. Preservation and Collection Collection <ul><li>List the date, time and description of the computer </li></ul><ul><li>List the identity of those assisting you and witnesses to your activity </li></ul><ul><li>Start Chronological Case Work Sheet: </li></ul>
  52. 52. Preservation and Collection Collection <ul><li>List the date, time and action taken </li></ul><ul><li>Record your investigative clues and leads </li></ul><ul><li>List the date, time and programs or utilities used </li></ul><ul><li>Continue use throughout the investigation and examination </li></ul><ul><li>Use Chronological Case Work Sheet : </li></ul>
  53. 53. Preservation and Collection Collection <ul><li>Photograph the computer using 35mm, polaroid, digital and/or video camera </li></ul><ul><li>Photograph the front and back of the computer </li></ul>
  54. 54. Preservation and Collection Collection <ul><li>Photograph cables </li></ul><ul><li>Disconnect power to the system, at the computer case </li></ul>
  55. 55. Preservation and Collection Collection <ul><li>Photograph attached hardware </li></ul><ul><li>Take pictures of anything that may be of value or used for evidence </li></ul><ul><li>This could be the hidden location of floppies, printed material, hard drives and other hardware </li></ul>
  56. 56. Preservation and Collection Collection <ul><li>Sometimes the “Devil is in the details”… </li></ul>
  57. 57. It is the small stuff that can create problems sometimes…
  58. 58. Preservation and Collection Collection <ul><li>Be sure to note “unusual” things about the condition of the evidence…. </li></ul>
  59. 59. Someone wanted this one dead…
  60. 60. Preservation and Collection Collection <ul><li>Mark and tag all cables and hardware </li></ul><ul><li>Use wire tags and stick on labels for each item seized </li></ul><ul><ul><li>This insures you can return the computer to it's original configuration </li></ul></ul>
  61. 61. Preservation and Collection Collection <ul><li>If you are seizing more than one computer system first number the computers and then tag the cables and hardware using the computer number so that when you get the whole mess back to the shop they can be put back together properly </li></ul>
  62. 62. Preservation and Collection Collection <ul><li>Prepare the computer for transport </li></ul>
  63. 63. Preservation and Collection Collection <ul><li>Package the computer, cables and other hardware in boxes after entering the evidence description in the search warrant property sheet </li></ul><ul><li>Keep boxes for each computer together during transport and storage </li></ul>
  64. 64. Preservation and Collection Collection <ul><li>Seizing floppies and other removable media </li></ul><ul><li>Count floppies and other removable media </li></ul>
  65. 65. Preservation and Collection Collection <ul><li>Mark them using an indelible colored marker or labels on tape or other stick on media </li></ul><ul><li>If you can’t itemize, describe and package </li></ul>
  66. 66. Preservation and Collection Collection <ul><li>Keep magnetic media separate from other seized items. This will aid you later in the examination of the disks so you don't have to look through dozens of boxes and envelopes for diskettes </li></ul>
  67. 67. Preservation and Collection Collection <ul><li>Place seized diskettes in separate boxes for each room </li></ul><ul><li>It will save you a lot of time and trouble sorting through them later </li></ul>
  68. 68. Preservation and Collection Collection <ul><li>Transportation of Evidence: </li></ul><ul><li>Pack the transport vehicle with care </li></ul><ul><li>Place the CPU and other computer related hardware and software in a safe place for transport </li></ul>
  69. 69. Preservation and Collection Collection <ul><li>Transportation of Evidence: </li></ul><ul><li>Items fall out of pickups and bounce around in large trucks </li></ul><ul><li>Magnets in radios in the trunks of vehicles and excessive heat can damage media or hardware </li></ul>
  70. 70. Preservation and Collection Summary <ul><li>Package properly </li></ul><ul><li>Handle carefully </li></ul><ul><li>Mark clearly </li></ul><ul><li>Primary rule: if you are comfortable, the computer is comfortable </li></ul>
  71. 71. High Tech Evidence Collection and Seizure <ul><li>Preservation and Collection </li></ul><ul><ul><li>Preservation </li></ul></ul><ul><ul><li>Collection </li></ul></ul><ul><ul><li>Physical chain of evidence </li></ul></ul>
  72. 72. Preservation and Collection Physical chain of evidence <ul><li>The “Chain of Evidence” is the: </li></ul><ul><li>Documentation of dominion and control of evidence </li></ul><ul><li>Physical security of evidence </li></ul>
  73. 73. Preservation and Collection Physical chain of evidence <ul><li>Maintain the “Chain of Evidence” </li></ul><ul><li>Evidence clearly marked so as to provide positive identification in court </li></ul><ul><li>Begins when evidence is identified </li></ul><ul><li>Ends when court/prosecutor releases same </li></ul>
  74. 74. Preservation and Collection Physical chain of evidence <ul><li>“ Chain of Evidence” presentation: </li></ul><ul><li>Documentation including reports and packaging should show: </li></ul><ul><ul><li>Agency case number </li></ul></ul><ul><ul><li>Person finding the evidence </li></ul></ul><ul><ul><li>Evidence number </li></ul></ul><ul><ul><li>Date </li></ul></ul><ul><ul><li>Time </li></ul></ul><ul><ul><li>Location found </li></ul></ul>
  75. 75. Preservation and Collection Physical chain of evidence <ul><li>“ Chain of Evidence” presentation: </li></ul><ul><li>Running log for each person handling (receiving) the evidence </li></ul>
  76. 76. Preservation and Collection Physical chain of evidence <ul><li>Documentation of the “Chain of Evidence”: </li></ul><ul><li>Photograph </li></ul><ul><li>Sketch </li></ul><ul><li>Mark/label </li></ul><ul><li>Package </li></ul><ul><li>Evidence label </li></ul><ul><li>Property booking report </li></ul><ul><li>Chronological search form </li></ul><ul><li>Lab evidence tracking report </li></ul><ul><li>Individual supplemental reports </li></ul>
  77. 77. High Tech Evidence Collection and Seizure <ul><li>Storage Guide </li></ul>
  78. 78. High Tech Evidence Storage <ul><li>Secure area </li></ul><ul><li>Moderate temperature </li></ul><ul><li>Free of excessive dust </li></ul><ul><li>No excessive moisture </li></ul><ul><li>Free of magnetic influence </li></ul>
  79. 79. High Tech Evidence Storage <ul><li>Storage containers </li></ul><ul><ul><li>Original packaging = the best material </li></ul></ul><ul><ul><li>Other options: </li></ul></ul><ul><ul><ul><li>Cardboard boxes </li></ul></ul></ul><ul><ul><ul><li>Wooden shelves </li></ul></ul></ul><ul><ul><ul><li>Non static containers </li></ul></ul></ul>
  80. 80. Questions ???
  81. 81. Pierce County Regional Computer Laboratory <ul><li>Detective Gregory Dawson </li></ul><ul><li>Work Ph. (253)798-7508 </li></ul><ul><li>Pager (253)680-1104 </li></ul><ul><li>Email [email_address] </li></ul><ul><li>If you have questions or need help please call!! </li></ul>

×