Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition
April 14, 2008
Chapter 1. Electronic Devices: Types, Description and Potential Evidence
Section 1 — Computer Systems
Description: A computer system consists of hardware and software that process data and is likely to include:
- A case that contains circuit boards, microprocessors, hard drive, memory, and interface connections.
- A monitor or video display device.
- A keyboard.
- A mouse.
- Peripheral or externally connected drives, devices, and components.
Computer systems can take many forms, such as laptops, desktops, tower computers, rack-mounted systems, minicomputers, and
mainframe computers. Additional components and peripheral devices include modems, routers, printers, scanners, and docking
stations. Many of these are discussed further in this chapter.
Potential evidence: A computer system and its components can be valuable evidence in an investigation. The hardware, software, documents, photos,
image files, e-mail and attachments, databases, financial information, Internet browsing history, chat logs, buddy lists,
event logs, data stored on external devices, and identifying information associated with the computer system and components
are all potential evidence.
Date Created: April 9, 2008