We've looked at the tools necessary for the collection and acquisition of physical evidence, but what tools do we need for the acquisition and extraction of digital evidence? Remember when we covered the different types of storage media back in Chapter 3, Understanding Filesystems and Storage Media? We saw that many of them had their own connectors as they were of various sizes.
Here's a list of some of the equipment required when acquiring data from evidence:
- Write blocker (can also be software-based)
- Card reader
- Various adapters (USB to SATA and EIDE, USB to various types of USB)
- Device cables such as power, SATA, EIDE, HDMI, VGA
- Networking cables such as straight-through, crossover, console
The following image shows a collection of various USB adapters, all costing under $10, and they are all available on Amazon:
For laptop drives, I also use a SATA to USB 3.0 adapter, as seen here:
For connecting to routers and switches, console cables and serial to USB cables can also be included in your kit, like the ones seen here:
All mobile devices including phones and tablets can also connect to laptops and desktops via USB ports. The following image shows an OTG cable, which can connect a USB device to phones or tablets with OTG capabilities:
Guidelines for physical collection and preservation:
- Label all cables and connectors
- Use labeled evidence collection bags as needed
- Special stronghold bags may have to be used when storing devices with wireless and radio capabilities, preventing communication with other devices
- Store sensitive equipment such as hard drives and flash drives in anti-static bags and protective casings
- Label containers used for storage during transportation
- Maintain the Chain of Custody forms when passing evidence from one person/handler to another (discussed later in this chapter)