Securing the scene

The first minutes at a scene decide much of what an examination can achieve. A careless click, a well-meant shutdown or an owner allowed back to the keyboard can change or destroy evidence before anyone records how things were. This lesson covers the practical work of the first responder: keeping people safe, controlling the area, documenting before touching anything and recording the state of every device. The reasons behind on-or-off decisions are in Module 1, and the legal authority to enter and search is in Module 2.

The first responder's role

ISO/IEC 27037 describes two roles. A Digital Evidence First Responder (DEFR) is a person who is authorized, trained and qualified to act first at a scene to collect and acquire digital evidence. A Digital Evidence Specialist (DES) has deeper technical knowledge and can handle situations beyond the DEFR's skills, such as capturing live data from a complex server. In a small team one person may fill both roles, but the distinction is useful: what happens at the scene must stay within the skills of whoever does it. A good DEFR knows those limits and calls a specialist rather than improvising.

Safety first

No evidence is worth an injury. First check the scene for hazards: damaged electrical equipment, exposed wiring, swollen or overheating lithium batteries, sharp objects and, sometimes, hostile people. Devices may also carry traditional forensic evidence, such as fingerprints or DNA. Wear gloves, and coordinate with any crime scene examiners so that physical evidence is collected without harming the digital evidence, and the other way round.

Control the area and the people

• Move people away from computers, phones and other devices, and do not let anyone touch them, including the owner or an IT manager.
• Note who was present, who uses each device and who had access to it before you arrived.
• Watch for attempts to reach a device, to call someone who could delete data remotely, or to hide small items.
• Keep a log of everyone who enters and leaves the area.
• Where permitted, ask in general terms about devices, accounts and passwords (Lesson 3.1).

Document before touching anything

Photographs and notes preserve the scene as found, so that later questions, such as what a screen showed, can be answered. Work from the general to the particular:

1. Overall photographs or video of the room, showing where each device sits.
2. Each device from the front and the back, including screens, cables, ports and connected peripherals.
3. The screen of every running device, close enough to read.
4. Each cable, labeled at both ends with the port it was connected to, before anything is unplugged.
5. A simple sketch showing device positions and the exhibit numbers that will be assigned.

Record the time of each step from a reliable time source, and note the time shown by each device. The difference matters later, when timestamps are analyzed (Module 6).

Devices that are on, off or in between

Module 1 explains why running and switched-off devices are treated differently. At the scene, what matters is the practical step and its record.

Phones deserve care: a phone that is switched off and on again usually returns to a state in which most of its data stays encrypted until the passcode is entered. On laptops whose battery cannot be removed, holding the power button forces the system off. Servers that run business services are a different case (Lesson 3.3).

What not to do

• Do not browse files, read messages, open applications or check "just one thing". Each action changes data and timestamps.
• Do not plug in USB drives or other devices, unless it is a deliberate, documented step of an acquisition.
• Do not run antivirus or cleanup tools. They can quarantine or delete files and change their metadata.
• Do not shut a computer down through its menu without first considering encryption and volatile data.
• Do not let the owner or a helpful colleague operate the device for you.

Isolating devices from networks

Isolation stops remote access, synchronization and remote wipe commands. In practice:

• Wired connections: photograph and label the network cable, then unplug it from the device and record the time.
• Phones and tablets: enable airplane mode and confirm that Wi-Fi and Bluetooth are off too, because on many phones they can stay on in airplane mode; or place the device in an RF-shielding bag (Lesson 3.3). Record every interaction with the device.
• Organization-managed devices: ask the IT team, through an authorized contact who is not involved in the matter, to suspend remote lock or wipe commands from their device management system.
• The router: switching it off isolates everything at once, but it may hold volatile logs and client lists (Lesson 3.1), so record or preserve what is needed first.

Recording identifiers and states

For every device, record the make, model, serial number, any asset tag and, for phones, the IMEI (the handset's unique identifier), which is often printed on a label, the SIM tray or the box. Add its state: on, off or asleep; locked or unlocked; battery level; charging or not; network connections; and anything shown on the screen. A pre-printed form helps ensure nothing is missed and keeps records consistent between team members (Module 5).

A worked scenario

Investigators from a fictional company, Norrvik Freight, arrive at an accounts office to collect evidence about altered supplier payments. An employee is sitting at the desk where the activity was traced.

1. The DEFR asks the employee to step away from the desk and notes who else is in the room.
2. The room, desk and screens are photographed. The desktop is on with the accounting application open, a USB drive is in a front port and a phone lies on the desk.
3. The screen is photographed without touching the mouse or keyboard. The disk is encrypted, so the DEFR calls the specialist, who decides whether to capture memory before power is removed (Module 4).
4. The phone is photographed, isolated from networks and connected to a power bank.
5. A sticky note under the keyboard that seems to show a password is photographed in place and recorded.
6. A small NAS in a cupboard is photographed and its cables labeled; the IT manager confirms it backs up the office computers.
7. Serial numbers, states and times go on the scene form before anything is packaged (Lesson 3.3).

Exam focus: Know the role of the Digital Evidence First Responder (DEFR) and how it differs from the Digital Evidence Specialist (DES) in ISO/IEC 27037. Expect scenario questions on the order of first actions (safety, control of people, photographs before touching), what to do with devices found on or off, what not to do (browse, plug in USB drives, run antivirus, shut down without thought), practical network isolation and its trade-offs, and which identifiers and states to record.