PAPERWORK FOR IMAGING and midterm imaging practicums Scenario

PAPERWORK FOR IMAGING (and midterm imaging practicums)

Scenario � � � Read the scenario Be creative with case # Be exact when describing system Digital copies of midterm have been uploaded as files Hard copies of midterm paperwork will be available on site

Consent to Search � � � You are the agent obtaining the consent to search Fill out make, model and serial number of computer Sign and date as witness

Chain of Evidence � � If we were taking the computer into evidence, we would check out one evidence item and check in two. You may fill the paperwork out that way Or log only the creation of the new working copy as best evidence

Computer Worksheet � � � The computer worksheet pertains to the computer system Note any serial numbers such as DSC/DSU inventory tags Mark anything you can to describe the system (what hardware does it have? )

Hard Drive Imaging Worksheet � The hard drive imaging worksheet pertains only to the computers hard drive � The hard drives physical characteristics � And the tools used to image and preview the hard drive

Exam Notes � Exam notes need to detail the actions of the examiner � Did you secure the scene � Did you document the scene � Did you record the MD 5 hash as presented by the Voom Hard. Copy � Did you wipe the drive or did someone else?

Crime Scene Photographs � � Keep a detailed log of all the photographs taken Save the photographs to the evidence drive with numbers that correspond to the log

Attaching the hard drive image to a computer Use the USB bridge to attach the hard drive to a computers

Attaching the hard drive image to a computer Insert the parallel side of the bridge to the hard drive

Attaching the hard drive image to a computer Insert the usb side of the bridge to the computers usb port

Attaching the hard drive image to a computer Connect the power cord to the drive

Checking the Image After the drivers install the Hardcopy will appear as an external drive

Checking the Image

The dd Image If you imaged correctly you should see the dd image and a. txt with the hash and other information regarding the hard drive and imaging

Viewing the Image You can preview the image (optional) using a hex editor like the free program FTKimager

Transferring the Photos To copy the pictures documenting the scene to the hard drive, simply remove the sd card from the camera

Transferring the Photos Place the sd card into the computer’s card reader

Transferring the Photos Open the SD card, copy your pictures and past them onto the Hard. Copy drive. (They are best if within a folder. )