IT IS STRONGLY RECOMMENDED THAT YOU CONSULT WITH TYCHO FS's EXPERTS PRIOR TO TAKING ANY ACTION WITH RESPECT TO THE COMPUTER SYSTEMS OR EVIDENCE.

contact us

Failure to preserve and maintain evidence continuity, chain of custody, and integrity can adversely affect the value of your evidence in legal proceedings. If you are not able to contact our Experts, the following guidelines should be followed:

>If the computer system is turned on and no advice is readily available, allow any printing to finish, do not attempt to shut down programs and the computer. Record accurately any on screen messages. Do not allow any individuals to disconnect, alter the state of, or use the computer. Never move a computer while it is switched on.

>If the computer system is already turned off, do not turn it on.

>If the computer is part of a network, seek immediate advice before disconnecting from the network.

>If the computer system is not in a location that can be secured with restricted access (for example, a private, locked office), label all cables and connectors (keyboard, mouse, printer, tape drive, network, etc.), including unused connectors, with adhesive labels so they may be correctly reconnected later. Do not power down or shut off the computer as normal. Instead, pull the electrical plug from the back of the computer. Seize the computer system, as well as any storage media that may contain evidence, including CDROMS, Zip disks, floppy disks, backup tapes, printouts, manuals, software installation media, etc. Store the seized items in a secure area, away from magnetic fields, and restrict access to this area to the smallest number of people possible (preferably only one person). Do not turn on or attempt to investigate the computer system or any of the storage media.

Copyright © 2003 by KCForensics.com