Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition

April 14, 2008

Chapter 5. Evidence Collection

Section 4 — Computers in a Business Environment

Business environments frequently have complicated configurations of multiple computers networked to each other, to a common server, to network devices, or a combination of these. Securing a scene and collecting digital evidence in these environments may pose challenges to the first responder.


Improperly shutting down a system may result in lost data, lost evidence, and potential civil liability.

The first responder may find a similar environment in residential locations, particularly when a business is operated from the home.

In some instances, the first responder may encounter unfamiliar operating systems or unique hardware and software configurations that require specific shutdown procedures. Such circumstances are beyond the scope of this guide.

Date Created: April 9, 2008