A forensic first responder arrives at the scene where an employee is suspected to have committed a computer-based crime.
Which of the following should the first responder do FIRST?
A.
Document the scene B.
Take pictures upon arrival C.
Secure the area D.
Implement chain of custody.
C.
A forensic first responder arrives at the scene where an employee is suspected to have committed a computer-based crime.
Which of the following should the first responder do FIRST?
A.
Document the scene
B.
Take pictures upon arrival
C.
Secure the area
D.
Implement chain of custody.
C.
When a forensic first responder arrives at the scene where an employee is suspected of committing a computer-based crime, the first thing they should do is to secure the area.
Securing the area involves restricting access to the area to prevent further tampering or alteration of the evidence. This is important because any evidence that is tampered with or altered in any way may not be admissible in court.
Once the area is secured, the forensic first responder can then document the scene. Documentation should include details such as the date and time of the investigation, names of the individuals involved, and a description of the scene.
After documenting the scene, the forensic first responder can then take pictures of the scene. Pictures should be taken from different angles to capture as much detail as possible.
Finally, the forensic first responder should implement a chain of custody to ensure the integrity of the evidence. Chain of custody refers to the documentation of the movement of evidence from the time it is collected until it is presented in court. This documentation should include who collected the evidence, where it was collected, when it was collected, and who has had possession of the evidence at all times.
In summary, the correct order of actions for a forensic first responder arriving at the scene of a computer-based crime is to: