First-Responder Protocols: Computers and Storage Media

Why First-Responder Decisions Matter

Digital evidence is fragile. Every action taken at a scene — or every action carelessly skipped — can permanently alter the data stored on a computer or drive. Courts require that evidence be collected in a way that preserves its integrity, and opposing attorneys will challenge any misstep. As the first responder, your job is not to examine or analyze the device; it is to recognize what you have, protect volatile data when appropriate, stop any further changes, and hand the device over to a forensic examiner in the best possible condition.

The National Institute of Justice (NIJ) Electronic Crime Scene Investigation guide is the baseline reference for these protocols. Follow it unless your agency's written policy requires something different, and document every choice you make.

Recognizing Device State

The first thing you assess when you approach any digital device is its power state: is it on, off, or in a sleep/standby mode?

• Monitor dark, no indicator lights, fan silent — the machine is likely off.
• Indicator lights on, fan audible, monitor lit or in screen-saver — the machine is running.
• Indicator lights on, fan quiet, monitor off — suspect sleep or standby; treat it as running until confirmed otherwise.

Never assume a device is off just because the screen is dark. Touch the mouse or keyboard is not the correct test — any keystroke or mouse movement can alter timestamps, clear a screen lock, or trigger auto-save routines. Instead, observe indicator lights and listen.

The Live-System Triage Decision

A running computer holds volatile data in RAM: open files, active network connections, running processes, encryption keys, and user login sessions. This data disappears the instant power is cut. The question is whether that volatile data is worth preserving.

Use this decision tree:

1. Is the machine running? If no, proceed to documentation and packaging. If yes, continue.

2. Is a trained digital forensic specialist available on scene or within a short response time? If yes, do not touch the machine; secure the area and wait — let the specialist perform live acquisition.

3. Is the machine actively destroying data (you can see a deletion or format in progress on screen)? If yes, a hard power-off (pulling the plug) may be justified to stop the process. Document your reason.

4. In all other live-system situations where no specialist is available, contact a supervisor or digital forensics unit by phone before proceeding. Follow your agency protocol.

The default rule: when in doubt, do not touch.

Controlled Shutdown vs. Hard Power-Off

A controlled shutdown (using the operating system's shutdown command) runs system processes that can alter evidence: it writes logs, updates file timestamps, and clears the swap file. For most forensic purposes a controlled shutdown is less desirable than a hard power-off.

A hard power-off (unplugging the power cord from the back of a desktop; removing the battery from a laptop) stops all writes immediately. This is the preferred method for most desktop scenarios because it preserves the disk state at that moment. For a desktop, pull the cord from the computer, not from the wall outlet — pulling from the wall outlet can still spin the drive down while the power supply capacitors discharge unpredictably on some machines.

Laptop exception: Remove the battery and unplug the AC adapter.

Isolation Steps for a Desktop Computer

Perform these six steps in order and narrate each one aloud for your partner to document:

1. Photograph the screen and the overall device setup before touching anything.

2. Document power state — call out exactly what you observe (lights, fan, display).

3. Disconnect network — unplug the Ethernet cable or, if wireless only, place the machine in a Faraday bag or disable the wireless adapter by physical switch if present, to prevent remote access or wiping.

4. Hard power-off — pull the power cord from the back of the computer.

5. Label all ports and cables with evidence tape or numbered labels before unplugging anything else.

6. Package and seal — place the computer in an anti-static evidence bag, apply tamper-evident seal, and complete the evidence label (make, model, serial number, time, your name, case number).

Isolation Steps for an External Hard Drive

1. Photograph in place.

2. Document connection type (USB, eSATA, Thunderbolt) and power state.

3. Do not click on the drive icon in the operating system — accessing it mounts the volume and can alter access timestamps.

4. Disconnect the data cable first, then the power cable if it has a separate one.

5. Label the cable ends and the drive's ports.

6. Package in an anti-static bag, seal, and complete the evidence label.

Safety and PPE Considerations

• Electrical safety: Never work around open computer cases or damaged cords without ensuring power is off. If you see arcing, burning smell, or damaged wiring, do not touch — treat it as an electrical hazard and call for assistance.
• Bloodborne pathogen risk: If the device is at a violent crime scene, wear nitrile gloves before handling. Change gloves between items to avoid cross-contamination of biological and digital evidence.
• Anti-static precautions: In dry environments, use an anti-static wrist strap or anti-static bag to avoid discharging static electricity into circuit boards when handling exposed media.
• Chain of custody begins now: Every item you touch must be logged. Use your field notes form from the moment you arrive.

Documentation Is Evidence

Your field notes are part of the evidentiary record. Write legibly, use 24-hour time, include device make/model/serial number, describe the power state in plain language, list every action you took and the reason, and sign your name. Incomplete notes can invalidate an otherwise perfect collection.