How can you collect digital evidence in a forensically sound manner?

Identify all possible sources of forensic data. That is your first step, think outside the box, not just computers phones and laptops. Look at smart devices, sensors, network drives, Bluetooth devices in the vicinity, vehicle electronics and digital storage, anything that has a Mac address, items capable of storing even the smallest amount of data. Also determine if there may have been other devices that may have been in the vicinity and have data pertaining to what may no longer be present on scene. Look out for any obvious pitfalls, think very carefully before powering, unlocking, or even moving a device. You only get one chance and caution saves future headaches exponentially.

Bevor man sich Gedanken über die Quellen macht, muss man sich Gedanken über die gesuchten Informationen machen. Daraus folgert sich dann, welche Quellen relevant sein k?nnten.

One thing I’ve found helps me is to first visualize what the process of obtaining the digital evidence from the device will entail. I record all my actions both physically in handling a device as well as obviously recording my screen. Also make sure that once evidence is in your care you document a separate copy of the who, what, when, in regards to your taking possession. From there on out it’s your job to ensure OPSEC, don’t walk away without securing all items and ensuring nothing has been left to chance in it being safely stored. Your coworker Dave might be thinking of life and love and trip covering everything in his path with that nasty protein shake he always has in hand. Bad things happen, prepare for the worst, perform as the best.

Lokale Besonderheiten beachten und Dokumentationsempfehlungen nicht einfach aus dem Netz nennen. Die Chain of Custody ist nur im Anglo-amerikanischen Recht pr?sent; dem Rest der Welt reicht simple Nachvollziehbarkeit.

When it comes to what tools you are going to use the first thing to remember is forget everything else but getting that data backed up. Whether it’s a 6TB SSD or a massive hulk of an ancient hard drive measuring in at 250 MB getting that Autopsy done is job one. Before you decide to slap on whatever connection is going to be required always carefully inspect the entire device. Look for bent pins, worn contacts, dents in the case, anything that might be indicative of a possible failure. If the item has pins ensure that there is not anything that could be a conductor contacting pins together.

Es gibt auch Staaten bei denen die Erstellung einer kompletten vollst?ndigen Kopie einer Festplatte als unverh?ltnism??ig angesehen wird. Lokale Besonderheiten beachten.

I’ve seen some bad storage jobs. Sandwich bags taped around magnetic media. Duct tape touching the actual device. You get the idea. Think of how the item probably came when it was new. Use an anti static Mylar zipper bag. Cover it with an opaque wrapping. Surround it with thin closed cell foam wrapping. Your job is to get it to the point where if you slipped on a banana peel cartoon style, while rubbing a balloon on your hair creating massive static, and fell into a hot tub, the item would probably survive just fine. Better a little overkill, than to kill the device.

- Calculate cryptographic hash values of the original evidence and its copies to verify their integrity. Any changes to the data will result in a different hash value. - Prioritize the collection of volatile data, such as running processes and network connections, as they can change or disappear rapidly. Capture this data first before proceeding with non-volatile evidence collection. - If relevant, gather evidence from cloud services and platforms used by the suspect. This could include retrieving data from cloud storage, analyzing logs from cloud-based applications, and examining virtual machine snapshots.