First page Back Continue Last page Summary Graphics

Acquisition – Takin’ it Off-Line

SLR – take pictures
Considerations before pulling the plug
Unplug the system from the network
If possible freeze the system such that the current memory, swap files, and even CPU registers are saved or documented
Unplug the system (power)
Packaging/labeling
Shipping

Notes:

SLR:
BEFORE PULLING ANY PLUGS:
Encrypted filesystem?
Is the Intruder present?
Latent Materials?
UNPLUG NETWORK:
UNPLUG POWER:
PACKAGING:
Label everything including cable ends and ports (ie., OWNEDBOX1:Cable-1:End-A, OWNEDBOX2:Monitor:Port-1/Had Cable-1:End-B, etc…)
Use non-static wrap
SHIPPING:
USPS Registered mail is the preferred std. Way
Package well & tamper evident
Package with “NO MAGNETS” and/or other std. Computer shipping practices
Record all tracking and shipping information
Accompany with proper paperwork (chain-of-custody, journals, background info) – keep originals

Acquisition – Takin’ it Off-Line

SLR – take pictures

Considerations before pulling the plug

Unplug the system from the network

If possible freeze the system such that the current memory, swap files, and even CPU registers are saved or documented

Unplug the system (power)

Packaging/labeling

Shipping

Notes: