Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition

April 14, 2008

Chapter 1. Electronic Devices: Types, Description and Potential Evidence

Section 2 — Storage Devices

Description: Storage devices vary in size and the manner in which they store and retain data. First responders must understand that, regardless of their size or type, these devices may contain information that is valuable to an investigation or prosecution. The following storage devices may be digital evidence:

  • Hard drives. Hard drives are data storage devices that consist of an external circuit board; external data and power connections; and internal magnetically charged glass, ceramic, or metal platters that store data. First responders may also find hard drives at the scene that are not connected to or installed on a computer. These loose hard drives may still contain valuable evidence.
  • External hard drives. Hard drives can also be installed in an external drive case. External hard drives increase the computer’s data storage capacity and provide the user with portable data. Generally, external hard drives require a power supply and a universal serial bus (USB), FireWire, Ethernet, or wireless connection to a computer system.
  • Removable media. Removable media are cartridges and disk-based data storage devices. They are typically used to store, archive, transfer, and transport data and other information. These devices help users share data, information, applications, and utilities among different computers and other devices.
  • Thumb drives. Thumb drives are small, lightweight, removable data storage devices with USB connections. These devices, also referred to as flash drives, are easy to conceal and transport. They can be found as part of, or disguised as, a wristwatch, a pocket-size multitool such as a Swiss Army knife, a keychain fob, or any number of common and unique devices.
  • Memory cards. Memory cards are small data storage devices commonly used with digital cameras, computers, mobile phones, digital music players, personal digital assistants (PDAs), video game consoles, and handheld and other electronic devices.

Potential evidence: Storage devices such as hard drives, external hard drives, removable media, thumb drives, and memory cards may contain information such as e-mail messages, Internet browsing history, Internet chat logs and buddy lists, photographs, image files, databases, financial records, and event logs that can be valuable evidence in an investigation or prosecution.

Date Created: April 9, 2008