CDI9-WEEK16.docx - CDI 9: INTRODUCTION TO CYBER CRIME AND...

In this module you will learn the procedures on how to secure and evaluate the crime
scene, the procedures on packaging, transportation and storage of evidences and the four types of
analysis.
At the end of this lesson, you should be able to:
1. Identify the four phases involved in the initial handling of digital evidence
2. Determine packaging, transportation, and storage
3. Explain the non-electronic evidence
Direction/Instruction: Look at the image presented below and describe it into 2 sentences. Write your answer on
the space provided below.
_________________________________
_________________________________
_________________________________
_________________________________
_________________________________
_________________________________
Topic: Securing and Evaluating the Scene
WELCOME CRIMINOLOGY STUDENTS
I. INTRODUCTION:
II. OBJECTIVES:
III. PRELIMINARY ACTIVITIES:
Before you proceed to the main lesson, answer the activity below.
Source: -
cybercrimes/
CDI 9: INTRODUCTION TO CYBER CRIME AND
ENVIRONMENTAL LAWS AND PROTECTION
Module 16: Securing and Evaluating the Scene
Page 1 of 16

SECURING AND EVALUATING THE SCENE
Measures should be taken by the first respondent to ensure the safety of all individuals at the scene and to
protect the integrity of all data, both conventional and electronic. All operations should comply with and departmental
policy, state, and local laws.
PROCEDURE:
After securing the scene and all personnel on the scene, possible evidence, both traditional (physical) and electronic,
should be visually detected by the first responder and determined whether perishable evidence remains. The first
responder should determine and devise a search plan for the scene.
1. Secure and Evaluate the Scene:
a. Follow the jurisdictional policy to safeguard the crime scene. This will require ensuring that all individuals from the
immediate area from which evidence is to be obtained are excluded. At this stage in the investigation, do not alter the
state of any electronic system: if it is off, leave it off. If it is on, keep it on.
b. Secure perishable records, physically and electronically. Perishable data can be found on pagers, caller ID boxes,
electronic organizers, mobile phones, and other similar items. The first responder should always bear in mind that any
computer containing perishable data should be protected, recorded, and/or photographed immediately.
c. Identify device-attached telephone lines, such as caller ID boxes and modems. Log disconnect and mark each
telephone line from the wall instead of the device, where feasible. There may also be other communication lines
present for LAN/ethernet connections. Contact the required personnel/agency in all situations.
2. Conduct Preliminary Interviews:
a. Separate and identify all persons (witnesses, Subjects, or others) at the scene and record their location at time of
entry.
b. Consistent with departmental policy and applicable law, obtain from these individuals information such as:
1. Owners and/or users of electronic devices found at the scene, as well as passwords, user names, and
internet service provider.