Company environments frequently have multiple computers connected to each other, to a central server, or both. Securing and processing a scene where the computer systems are networked poses special problems, as improper shutdown may destroy data or disrupt the business. This can result in loss of evidence and potential liability. When investigating activity in a known business environment, if possible, the presence of a computer network should be planned for in advance and appropriate expert assistance obtained. It should be noted that computer networks can also be found in a home environment and the same concerns exist.
The possibility of various operating systems and complex hardware configurations requiring different shutdown procedures make the processing of a network incident scene quite complicated. It is important that computer networks can be recognised and identified, so that expert assistance can be obtained.
Indications that a computer network may be present include:
* The presence of multiple computer systems.
* the presence of cables and connectors, running between computers or central devices such as hubs
* information provided by individuals at the scene
* the presence of network components
* a wireless PCMCIA / USB device, or an access point or aerial
principle: Computer evidence, like all other evidence, must be handled carefully and in a manner that preserves its evidential value. This relates not just to the integrity of an item or device, but also to the electronic data it contains. Certain types of computer evidence therefore require special collection, packaging, and transportation. Consideration should be given to protect data that may be susceptible to damage or alteration from electromagnetic fields such as those generated by static electricity, magnets, radio transmitters, and other devices.
policy: Electronic evidence should be collected according to your organizational guidelines. In the absence of guidelines outlining procedures for electronic evidence collection, the following procedures are recommended.
Note: Prior to collection of evidence, it is assumed that locating and documenting has been done as previously described. Appreciate that other types of evidence such as DNA, or fingerprints may exist.
Data recovery Salon welcomes your comments and share with us your ideas, suggestions and experience. Data recovery salon is dedicated in sharing the most useful data recovery information with our users and only if you are good at data recovery or related knowledge, please kindly drop us an email and we will publish your article here. We need to make data recovery Salon to be the most professional and free data recovery E-book online.