Central processing units (CPUs)
Often called the ‘chip’, it is a microprocessor located inside the computer. The microprocessor is located in the main computer box on a printed circuit board with other electronic components.
primary uses: Performs all arithmetic and logical functions in the computer. It controls the operation of
potential evidence: The device itself may be evidence of component theft, counterfeiting, or remarking.
Removable circuit board(s) inside the computer. Information stored here is usually not retained when the computer is powered down.
primary uses: Stores user’s programs and data while computer is in operation.
potential evidence: The device itself may be evidence of component theft, counterfeiting, or remarking. A large amount of evidence may be stored in memory (RAM) when the computer is powered up. This is lost when the machine is switched off.
Access control devices – smart cards, dongles, biometric scanners
A smart card is a small hand-held device that contains a microprocessor that is capable of storing a monetary value, encryption key or authentication details (password), digital certificate, or other information. A dongle is a small device that plugs into a computer port that contains types of information similar to information on a smart card. A biometric scanner is a device connected to a computer system that recognizes physical characteristics of an individual (e.g., fingerprint, voice, hand, retina).
primary uses: Provides access control to computers or programs or functions as an encryption key.
potential evidence: Identification/authentication information of the card and the user, level of access,
configurations, permissions, and the device itself.
Camera, digital recording device for images and video, with related storage media and conversion hardware capable of transferring images and video to computer media.
primary uses: Digital cameras capture images and/or video in a digital format that is easily transferred to computer storage media for viewing and/or editing.
time and date stamps
A sealed box containing rigid platters (disks) coated with a substance capable of storing data magnetically. Can be encountered in the case of a PC or laptop as well as externally in a standalone case.
primary uses: Storage of information such as computer programs, text, pictures, video, multimedia files etc.
potential evidence: Please find it here
An electronic device that is part of a telephone or connected between a telephone and a landline connection. Some models use magnetic tapes, while others use an electronic (digital) recording system.
primary uses: Records voice messages from callers when the called party is unavailable or chooses not to answer a telephone call. Usually plays a message from the called party before recording the message.
potential evidence: Answering machines can store voice messages and, in some cases, time and date information about when the message was left. They may also contain other voice recordings.
caller identification information
last number called
phone numbers and names
Since batteries have a limited life, data could be lost if they fail. Therefore, investigation personnel should ensure that a device powered by batteries is given the appropriate attention.
Hand-held devices – personal digital assistants (PDAs), electronic organizers, iPAQ
A personal digital assistant (PDA) is a small device that can include computing, telephone/fax, paging, networking, wireless, Internet and other features. They are typically used as personal organisers and have almost the full functionality of a desktop computer system. Some do not contain disk drives, but may contain PC card slots that can hold a modem, hard drive, memory stick or other device. They usually include the ability to synchronise their data with other computer systems, most commonly by a connection in a cradle, or via Bluetooth or wireless. If a cradle is present, attempt to locate the associated hand-held device.
primary uses: Hand-held computing, storage, and communication devices capable of storage of information.
Note: Since batteries have a limited life, data could be lost if they fail. Therefore, investigation personnel should ensure that a device powered by batteries is given the appropriate attention.
Removable electronic storage devices, which do not lose the information when power is removed from the card. It is possible to recover deleted data (e.g. erased images) from memory cards. Memory cards can store thousands of images in a small module. Used in a variety of devices, including computers, digital cameras, mobile phones, games consoles and PDAs. Examples are memory sticks, smart cards, flash memory, SD storage, and flash cards. There are many different types of these, usually FAT formatted.
primary uses: Provides additional, removable methods of storing and transporting information.
potential evidence: See potential evidence under computer systems.
Modems, internal and external (analogue, DSL, ISDN, cable), wireless modems, PC cards. primary uses: A modem is used to facilitate electronic communication by allowing the computer to access other computers (usually for Internet access) and/or networks via a telephone line, broadband, wireless, or other communications medium.
potential evidence: The device itself.