Computer fraud, forensic investigations

CORPORATE INVESTIGATION COMPUTER FRAUD	City: 0207 158 0332 Office: 01483 200999
www.answers.uk.com

info@answers.uk.com

IT FORENSICS 5 - ACTION ON SCENE

Preserving Evidence First actions are important. When on scene we will follow the following steps - if in doubt do not attempt this yourself prior to our staff's arrival. At all times, we will record all actions taken and so should you:

Preserving Evidence is the first priority, therefore there are steps to be taken which may prove vital later on. Something not to be forgotten is that those first on a scene should take steps to ensure the safety of all persons and of course to ensure the integrity of evidence. All activities should adhere to your company's organisational policy and the law. Ideally, of course, a locus will be left alone until qualified personnel are available. If you can, visually identify potential evidence whether physical or electronic and evaluate whether any is fragile.

Monitor is on/Desktop visible	Monitor is on/ screen blank	Monitor is off
Photograph screen and note info displayed Remove the power cable from the computer (not from the wall) If a laptop, remove the battery Record make, model and serial number and any other evidence	Move the mouse - if the screen changes photograph screen and note info displayed Remove the power cable from the computer (not from the wall) If a laptop, remove the battery Record make, model and serial number and any other evidence	Make a note of monitor being off and turn on - be careful not to leave fingerprints Photograph screen and note info displayed Remove the power cable from the computer (not from the wall) If a laptop, remove the battery Record make, model and serial number and any other evidence

Call our Head Office on 01483 200999 Our first action will be to arrange collection of the machine to enable us to make a first generation copy and initiate documentation procedures. It may be possible to clone the machine on-site, however this is more easily done overnight, with the machine returned to you next day. We can, if appropriate, also arrange for relevant examiners (e.g. fingerprinting) to be on-site at first opportunity