First Responder's Guide to Cybercrime

Essential protocols for law enforcement officers responding to cybercrime scenes. Protect digital evidence and avoid common mistakes that can compromise investigations.

⚠️ CRITICAL REMINDER

Digital evidence is extremely fragile. A single wrong keystroke can destroy crucial evidence or trigger malware that wipes the entire system. When in doubt, photograph and document - DO NOT INTERACT.

🚨 If you're unsure about any action, STOP and consult a digital forensics expert immediately. It's better to preserve what you have than risk losing everything.

First 10 Minutes: Critical Actions

1

Secure the Scene

Treat digital devices like physical evidence

Critical
  • Do NOT touch keyboards, mice, or screens
  • Photograph all devices and their current state
  • Document all visible information on screens
  • Prevent unauthorized access to the scene
2

Document Everything

Create a comprehensive record of the scene

Critical
  • Take photographs from multiple angles
  • Note time, date, and environmental conditions
  • Record model numbers and serial numbers
  • Document cable connections and network setup
3

Identify Live Systems

Determine which devices are powered on

High
  • Look for powered-on computers or devices
  • Check for active network connections
  • Note any running programs or applications
  • Observe any automatic processes or timers

Device-Specific Handling Procedures

Desktop Computers

📱 If Device is ON:

  • Photograph the screen before any action
  • Do NOT click on anything or use the mouse
  • Look for running processes or open applications
  • If urgent data loss risk, consult digital forensics expert immediately

💤 If Device is OFF:

  • Do NOT turn on the device
  • Photograph all connections and ports
  • Carefully disconnect power and network cables
  • Place evidence tape over power button and ports

Laptops

📱 If Device is ON:

  • Do NOT close the laptop - this may trigger sleep/hibernation
  • Photograph screen and keyboard area
  • Note battery level if visible
  • Keep power adapter connected if present

💤 If Device is OFF:

  • Do NOT open or power on
  • Photograph closed laptop and all ports
  • Note model, serial number, and any damage
  • Secure power adapter separately

Mobile Devices

📱 If Device is ON:

  • Do NOT touch the screen or press buttons
  • Place in airplane mode if legally permissible
  • Photograph lock screen and any notifications
  • Use Faraday bag to prevent remote wiping

💤 If Device is OFF:

  • Do NOT attempt to power on
  • Place immediately in Faraday bag
  • Document model, IMEI, and physical condition
  • Secure charging cables separately

Critical Mistakes to Avoid

❌ DON'T:

Clicking "OK" or "Cancel" on Dialog Boxes

Why It's Dangerous:

May execute malware or destroy evidence

✅ DO Instead:

Photograph the dialog and leave it unchanged

❌ DON'T:

Shutting Down Running Systems

Why It's Dangerous:

Destroys volatile memory and running processes

✅ DO Instead:

Consult digital forensics expert for live acquisition

❌ DON'T:

Connecting USB Drives or External Media

Why It's Dangerous:

Can trigger autorun malware or alter evidence

✅ DO Instead:

Document all connected devices but do not add new ones

❌ DON'T:

Using the Suspect's Computer to Write Reports

Why It's Dangerous:

Alters file timestamps and creates new evidence

✅ DO Instead:

Use separate equipment for all documentation

❌ DON'T:

Moving or Copying Files

Why It's Dangerous:

Changes metadata and potentially destroys evidence

✅ DO Instead:

Leave all files in their original location

Emergency Scenarios & Responses

🚨 Active Malware Detected

Immediate Action:

Disconnect network cable (NOT power)

Why:

Prevents data exfiltration while preserving memory

🚨 Screen Shows File Deletion in Progress

Immediate Action:

Photograph screen, then consult forensics expert

Why:

Document the destruction process but avoid interference

🚨 Remote Access Tool Detected

Immediate Action:

Disconnect network immediately

Why:

Prevents remote control or evidence destruction

🚨 Encryption Process Starting

Immediate Action:

Document and disconnect power if advised by expert

Why:

May need to preserve unencrypted state

Chain of Custody Requirements

Initial Seizure

  • Unique identifier for each device
  • Date and time of seizure
  • Location of seizure
  • Condition of device when found

Transportation

  • Secure packaging to prevent damage
  • Anti-static bags for electronic components
  • Climate-controlled environment
  • Documentation of transport conditions

Storage

  • Secure evidence room or locker
  • Environmental controls (temperature, humidity)
  • Access logging for all handlers
  • Regular condition checks

Quick Reference Card

✅ ALWAYS DO

  • • Photograph before touching anything
  • • Document all observations immediately
  • • Preserve power state of devices
  • • Use Faraday bags for mobile devices
  • • Maintain detailed chain of custody
  • • Call digital forensics expert when unsure

❌ NEVER DO

  • • Click on anything on screens
  • • Power on devices that are off
  • • Insert USB drives or media
  • • Use suspect's equipment for reports
  • • Shutdown running systems abruptly
  • • Move or copy files

📞 Emergency Contact: Have your digital forensics unit's contact information readily available. When in doubt, call immediately - evidence preservation cannot be undone.