Computer Evidence Processing Step 1 -- Seizure of the Computer

August 31, 1997 By Michael R. Anderson

subterfuge to remove the operator from the computer to eliminate the possibility of them destroying potential evidence. Raid planning is very important, and this is especially true if the probability of destructive processes exist.

Watch out for "burn boxes" at the raid site which might be rigged to incinerate floppy diskettes and zip disks. Also, avoid storing the computer components near the police car radio. The magnetic field created by the operating radio may be strong enough to destroy evidence. A word to the wise -- don't transport the seized computer in the trunk on top of the radio transmitter.

Michael R. Anderson, who retired from the IRS's Criminal Investigation Division in 1996, is internationally recognized in the fields of forensic computer science and artificial intelligence. Anderson pioneered the development of federal and international training courses that have evolved into the standards used by law enforcement agencies worldwide in the processing of computer evidence.

He also authored software applications used by law enforcement agencies in 16 countries to process evidence and to aid in the prevention of computer theft. He continues to provide software free of charge to law enforcement and the military. He is currently a consultant. P.O. Box 929 Gresham, OR 97030. E-mail: .

September Table of Contents

PREV 1 | 2 | 3 NEXT

You may use or reference this story with attribution and a link to
http://www.govtech.com/magazines/gt/Computer-Evidence-Processing-Step-1---.html

| More

Comments

Add Your Comment

Name *

Comment *

You are solely responsible for the content of your comments. We reserve the right to remove comments that are considered profane, vulgar, obscene, factually inaccurate, off-topic, or considered a personal attack.