Scribd Logo
Upload

Welcome to Scribd!

  • Computer Examination Form - Master

    Uploaded by

    krisnadwi09
    3 views2 pages
    This document summarizes a computer forensic examination conducted by the Central Point Police Department's High-Tech Crimes Unit Digital Evidence Forensic Laboratory. It details information about the suspect system that was examined such as the computer make, model, and serial number. It also describes the process used to remove and acquire the suspect hard drive for imaging and forensic analysis on their forensic workstation using software like FTK. Basic information about the examination is also provided like the exam date, software and versions used, and whether virus definitions were up to date.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    DOC, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document summarizes a computer forensic examination conducted by the Central Point Police Department's High-Tech Crimes Unit Digital Evidence Forensic Laboratory. It details information about the suspect system that was examined such as the computer make, model, and serial number. It also describes the process used to remove and acquire the suspect hard drive for imaging and forensic analysis on their forensic workstation using software like FTK. Basic information about the examination is also provided like the exam date, software and versions used, and whether virus definitions were up to date.

    Copyright:

    © All Rights Reserved
    Download as DOC, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as doc, pdf, or txt
    3 views2 pages

    Computer Examination Form - Master

    Uploaded by

    krisnadwi09
    This document summarizes a computer forensic examination conducted by the Central Point Police Department's High-Tech Crimes Unit Digital Evidence Forensic Laboratory. It details information about the suspect system that was examined such as the computer make, model, and serial number. It also describes the process used to remove and acquire the suspect hard drive for imaging and forensic analysis on their forensic workstation using software like FTK. Basic information about the examination is also provided like the exam date, software and versions used, and whether virus definitions were up to date.

    Copyright:

    © All Rights Reserved
    Download as DOC, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as doc, pdf, or txt
    of 2

    CENTRAL POINT POLICE DEPARTMENT

    HIGH-TECH CRIMES UNIT


    DIGITAL EVIDENCE FORENSIC LABORATORY
    COMPUTER SYSTEM EXAMINATION & IMAGING

    Today’s Offense Date Exam Date Time of Exam Agency Case # HTCU/DEFL Case #
    Date
    8/14/05
    Case Agent Name Agency Search Warrant Consent
    Ashland PD No No

    SUSPECT SYSTEM UNIT INFORMATION & PROCEDURES

    Computer Make Model Serial # Case Style


    Tower
    Photographs taken Bios Date Actual Date Bios Time Actual Time
    Yes

    COMPUTER OR DATA SEIZURE PROCESS

    Remove cover and disconnect hard drive cables


    Note overall condition and type of hardware installed
    Photograph interior and exterior of computer system and media storage devices
    Boot suspect machine with forensic boot disk
    CMOS access keys (passwords)
    BIOS manufacturer
    Boot sequence
    CPU Make/Type
    Amount of RAM
    Any partitions noted Yes If yes, size(s)
    Subject HDD removed or left in computer: Removed

    HDD # Model Serial Number

    FORENSIC IMAGE

    Suspect HDD acquired in: Software Used Version Hardware Write Blocker Used
    Lab Spada
    Software Write Blocker Used Forensic Workstation Used Forensic Examination Software Used
    FTK
    Version of Examination Software Virus Definitions Current Virus Software & Version
    Yes
    Evidence File Name Location Stored Do MD5 Values Match
    For HTCU Use Only

    Date Received
    HTCU Investigator Assigned Moulin
    HTCU Case Number
    Date Original Evidence Returned
    Other Notes

    You might also like