First Response and the Electronic Crime Scene

What it is

The first responder is the first person with the training and authority to act at a possible electronic crime scene. What this person does in the first minutes decides whether volatile data survives and whether the evidence will be accepted later.

First response covers securing the scene, documenting it, obtaining legal authority, seizing devices and preserving evidence. The exam tests order of actions, who does what, and common errors.

How it works

First response basics

A responder's goals are to protect people, protect the scene and protect the evidence, in that order of concern. Typical steps:

1. Ensure safety and secure the area. Remove unauthorized people from the devices.
2. Record the scene before touching anything.
3. Identify devices, network connections and the power state of each.
4. Decide, with the lead investigator, whether to capture volatile data before power is cut.
5. Seize, label and package items.
6. Hand over with a chain of custody record.

Do not let the suspect or other staff touch or shut down equipment. Do not use the suspect's computer to look around.

Who responds

Administrators are close to the evidence and likely to be first on the scene. Their actions can change it, so every step is written down and their access is limited to what policy allows.

First responder common mistakes

• shutting down or unplugging a system without deciding what volatile data is lost
• working directly on the original device or the suspect's live system
• failing to photograph or document before moving anything
• not recording the screen content, running programs and time
• ignoring wireless devices, removable media and hidden storage
• letting evidence be handled by untrained people
• missing legal authority, so that the evidence is later challenged
• failing to keep a chain of custody

Health and safety

The scene can harm the people working in it. Typical hazards:

Safety always comes before evidence collection.

Documenting the electronic crime scene

Documentation lets someone who was not there understand how the scene looked. It includes:

• photographs and video of each room, device, screen, cables and labels
• a sketch of the layout showing where each item was found
• written notes with times, names and observations
• a list of every item with make, model and serial number
• a note of the power state and whether the device was connected to a network
• an evidence log and chain of custody form for each item

Photograph before touching, and photograph the back of devices to show cabling.

Search and seizure

Searching and taking devices requires legal authority. The usual routes are a search warrant, consent from someone with authority over the property, or a recognized exception such as exigent circumstances or plain view.

In a corporate setting, the policy and employment agreements may give the employer the right to examine company equipment, but legal counsel confirms this first. The warrant defines what may be searched and seized, so stay inside its scope. Seize the devices and the related items such as storage media, notes, manuals and passwords.

Evidence preservation

Preservation keeps the evidence in the state it was found.

• Use write blockers and work on images, not originals.
• Use antistatic bags for components and Faraday bags for phones, so they cannot receive a remote wipe.
• Label each item with case number, item number, date, time and the person who collected it.
• Record a hash of each image.
• Store in locked, cool, dry, magnetically safe conditions.
• Log every transfer in the chain of custody.

A worked example

A responder arrives at an office where an employee is suspected of data theft. The responder keeps staff away from the workstation and photographs the screen, which shows a file transfer in progress. The investigator decides to capture memory first, then shuts the machine down properly.

The responder bags the disk and a USB drive, labels them and signs the chain of custody form. A warrant covering the workstation was already in hand.

How the exam asks about this

• "What should a first responder do before touching a device at the scene?" → Document it with photographs and notes.
• "Which bag protects a seized phone from remote wipe?" → A Faraday bag.
• "Which document shows who held evidence and when?" → The chain of custody record.