| <<< Suspect Computer, Hard Drives | Index | BIOS and Harddrive Acquisition Form >>> |
At the lab, remove all hard drives from the suspect computer.
Check floppy drives -- they should be empty -- then boot the suspect's computer.
Record BIOS day/time and system configuration.
Move the suspect computer to the evidence preservation and storage room.
| <<< Suspect Computer, Hard Drives | Index | BIOS and Harddrive Acquisition Form >>> |