Recognizing sources of evidence

Before anything can be collected, someone has to recognize where evidence might be. Identification, the first phase of the forensic process (Module 1), is harder than it looks: traces of a single event can sit on a dozen devices, in several online services and in the memory of the people involved. This lesson surveys the sources an investigator should look for, including the easily missed ones, and how to decide which to deal with first. Securing the scene is covered in Lesson 3.2, and acquiring the data in Module 4.

Start from the questions

The questions of the case decide what counts as a source. In a harassment case, the messages and the accounts and devices that sent them matter most; in a data theft case, storage media, cloud synchronization and the file server's access logs. For each question, ask where traces of the relevant actions would have been created, copied or synchronized. The answers usually fall into a few groups: devices, the network, online services and the people themselves.

Computers and storage media

Desktop and laptop computers remain central sources: documents, browser history, email clients, chat applications, operating system logs and records of connected devices. Their storage comes in several forms.

• Hard disk drives (HDDs) store data on spinning magnetic platters. Deleted data often survives until it is overwritten.
• Solid-state drives (SSDs) use flash memory. Many connect through the SATA interface; NVMe drives connect over PCI Express and are often small M.2 cards. Some laptops have their storage soldered to the motherboard, so there is no drive to remove.
• USB flash drives and memory cards, such as SD and microSD cards, are small and easy to hide. A microSD card is about the size of a fingernail.
• Optical media (CD, DVD and Blu-ray discs) are less common today but still turn up in archives and older systems.

Removable media turns up in unusual places: inside books, coat pockets, phone cases or game consoles, taped under drawers, or disguised as a key ring or pen. Search for it deliberately.

Phones, wearables and connected things

Phones and tablets often hold more about a person's life than any computer: messages, calls, contacts, photos with location data and app data. They are also the devices most exposed to remote change, which is why they get special handling in Lessons 3.2 and 3.3.

• Wearables, such as smartwatches and fitness trackers, record activity, heart rate and sometimes location, and usually synchronize with a phone app and the vendor's cloud service.
• Smart home and IoT devices (Internet of Things), such as smart speakers, doorbell cameras, thermostats and smart locks, keep event histories: when a door was unlocked, when motion was detected. Much of that history often sits in the vendor's cloud service, reached through the user's account, rather than on the device.
• Vehicles can hold paired phones, contacts, call logs and navigation history in the infotainment system, while telematics units may report location and driving events to a service provider.
• Game consoles have user accounts, messaging, browsers and storage, and are easily overlooked.

Network devices, cameras and online services

• Routers and firewalls show which devices connected and where traffic went: lists of connected clients, DHCP leases (records of which network address was given to which device) and connection logs. Many home routers keep their logs only in memory, so a restart erases them.
• NAS devices (network-attached storage) are small file servers, often holding shared files and backups of several computers on disks combined in a RAID array.
• CCTV cameras and recorders (DVRs and NVRs, digital and network video recorders) record continuously and overwrite the oldest footage when the disk is full, often after days or weeks. Their clocks are frequently wrong, so the difference between the recorder's time and a reliable reference must be noted.
• Cloud accounts and online services, such as email, file storage, social media, messaging and device backups, may hold data that no longer exists on any device. A provider holds that data, often in another country, and it is obtained through the account holder or the provider under proper authority (Module 2).

Less obvious sources

• Printers and multifunction devices may keep a history of print, copy and scan jobs, and some models have internal storage.
• SIM cards identify the mobile subscription. The card's serial number (ICCID) is printed on it, and a SIM can store a small number of contacts and text messages, although modern phones keep most data on the handset.
• Backups on external drives, NAS shares, old phones and computers (which often hold backups of phones) can contain data deleted from the current device.
• Synchronized devices: messages, photos and browser history from one device often appear on a tablet, a second computer or a desktop messaging app linked to the same account.
• Written passwords and notes: sticky notes, notebooks and papers near a computer. They may later unlock an encrypted device, so they are photographed in place and handled as exhibits.

The person as a source

The people at a scene often know what no tool can find quickly: which devices they use, which accounts they hold, whether storage is encrypted and what the passwords are. Asking about them, in general terms, can save days of work. Whether such questions may be asked, and whether anyone must answer, depends on the legal framework and the investigator's role (Module 2). In organizations, IT staff know where logs are kept, how long they are retained and who has administrative access. Record each question, the answer and the time. A password obtained at the scene is not used to browse the device; it is used later, in a controlled and documented acquisition (Module 4).

Deciding what comes first

Not every source can be handled at once. Building on the order of volatility (Module 1), weigh four factors.

1. Relevance: how directly the source bears on the questions of the case.
2. Volatility and risk of loss: how soon the data could disappear through power loss, overwriting, log rotation or remote deletion.
3. Uniqueness: whether the data exists only here or also elsewhere, such as on a server that is already preserved.
4. Effort and impact: how long collection takes and how much it disrupts the owner or a business.

A CCTV recorder about to overwrite last week's footage may come before a switched-off laptop that will keep. Recording the priorities and reasons supports their justifiability.

Sources at a glance

Exam focus: Know the main groups of evidence sources (computers and storage media, phones and tablets, wearables, IoT and smart home devices, vehicles, network devices, CCTV recorders, game consoles, cloud accounts) and the less obvious ones: printers, SIM cards, backups, synchronized devices and written passwords. Expect scenario questions on prioritizing sources by relevance, volatility and risk of loss, uniqueness and effort, on router logs and CCTV overwriting, and on the person as a source of information about devices, accounts and passwords.