Electronic Crime Scene Investigation: A Guide for First Responders

April 14, 2008

Chapter 7. Electronic Crime and Digital Evidence Considerations by Crime Category

Section 2 — Computer Intrusion

Potential digital evidence in computer intrusion investigations includes:

• Computers.
• Network devices, routers, switches.
• Handheld mobile devices.
• Antennas.
• Removable media.
• External data storage devices.
• Web camera(s).
• Wireless network equipment.
• Lists of contacts and address books.
• Lists of Internet protocol addresses.
• Lists or records of computer intrusion software.
• Records of Internet chat sessions.
• Printed e-mail, notes, and letters.
• Printed computer program code.
• Executable programs.
• Lists of computers accessed.
• Notes or records of Internet activity.
• Usernames and passwords.