Documentation of the scene creates a permanent historical record of the scene. Documentation is an ongoing process throughout the investigation and it is important to accurately record the location and condition of computers, storage media, other electronic devices, and conventional evidence.
policy: Documentation of the scene should be created and maintained in compliance with your organisational policy and ACPO guidance.
procedure: The scene should be documented in detail.
Initial documentation of the physical scene:
* Observe and document the physical scene, such as the position of the mouse and the location of components relative to each other (e.g. a mouse on the left side of the computer may indicate a left-handed user).
* Document the condition and location of the computer system, including power status of the computer (on, off, or in sleep mode). Most computers have status lights that indicate if the computer is on. Likewise, if fan noise is heard, the system is probably on. Furthermore, if the computer system is warm, that may also indicate that it is on or was recently turned off.
* Identify and document related electronic components that will not be seized.
* Photograph the entire scene. The complete room should be recorded with 360° of coverage, if possible.
* Photograph the front of the computer as well as the screen and other components. Also take
written notes on what appears on the monitor screen.
Note: Movement of a computer system while the system is running may cause changes to system data. The system should not be moved until it has been safely powered down or switched off.