Electronic Crime Scene Investigation: A Guide for First Responders
April 14, 2008
Chapter 1. Electronic Devices: Types, Descriptions and Potential Evidence
Section 6 — Computer Networks
Description: A computer network consists of two or more computers linked by data cables or by wireless connections that share or are capable
of sharing resources and data. A computer network often includes printers, other peripheral devices, and data routing devices
such as hubs, switches, and routers.
Potential evidence: The networked computers and connected devices themselves may be evidence that is useful to an investigation or prosecution.
The data they contain may also be valuable evidence and may include software, documents, photos, image files, e-mail messages
and attachments, databases, financial information, Internet browsing history, log files, event and chat logs, buddy lists,
and data stored on external devices. The device functions, capabilities, and any identifying information associated with the
computer system; components and connections, including Internet protocol (IP) and local area network (LAN) addresses associated
with the computers and devices; broadcast settings; and media access card (MAC) or network interface card (NIC) addresses
may all be useful as evidence.
Date Created: April 9, 2008