The following is a list of crimes which may involve the use of a computer or other electronic media. Also listed below is the potential evidence which may be recovered from various types of electronic evidence. Computer Fraud Investigations:
• Account data from online auctions
• Accounting software and files
• Address books
• Calendar
• Chat Logs
• Customer information
• Credit card data
• Databases
• Digital camera software
• E-mail, notes and letters
• Financial and asset records
Child Abuse and Pornography Investigations:
• Chat logs
• Digital camera software
• E-mails, notes and letters
• Games
• Graphic editing and viewing software
• Images
• Internet activity logs
• Movie files
• User created directory and file names which classify images
Network Intrusion Investigations:
• Address books
• Configuration files
• E-mails, notes and letters
• Executable programs
• Internet activity logs
• Internet protocol address & usernames
• Internet relay chat logs
• Source code
• Text files and documents with usernames and passwords
Homicide Investigations:
• Address books
• E-mails, notes and letters
• Financial asset records
• Internet activity logs
• Legal documents and wills
• Medical records
• Telephone records
• Diaries
• Maps
• Photos of victim / suspect
• Trophy photos
Examinations can determine what type of data files are in a computer.
Comparison Examinations
Comparison Examinations can compare data files to known documents and data files.
Transaction Examinations
Transaction Examinations can determine the time and sequence that data files were created.
Deleted Data Files
Deleted data files can be recovered from the computer. Data files can be converted from one format to another.
Keyword Searching
Data files can be searched for a word or phrase and all occurrences recorded.
Passwords
Passwords can be recovered and decrypted. Source code can be analyzed and compared.
Storage Media
Storage media used with stand-alone word processors can be examined.
For most examinations, examiners need only the central processing units and the internal and external storage media. Use a sturdy cardboard container when shipping computer components. If possible, use the original packing case with the fitted padding. Use large, plastic bubble wrap or foam rubber pads as packing. Do not use loose Styrofoam because it lodges inside computers and/or components and creates static charges that can cause data loss or damage to circuit boards.
Seal the container with a strong packing tape. Pack and ship central processing units in the upright position. Label the outside container "This End Up".
Disks, cartridges, tapes, and hard drives should be packed to avoid movement during shipping. Label the outer container Fragile, Sensitive Electronic Equipment and Keep Away From Magnets Or Magnetic Fields.
