21. Hardware Collection Pitfalls

• It's a good plan to have hardware examined later in a controlled environment, but there are many things to consider:

  • Instantly destroying all volatile evidence in computer RAM at the scene of the crime by instantly cutting power is questionable.

  • Risking damaging the equipment in transit

  • Risking not being able to boot if BIOS password is set

  • Risking not being able to access evidence on encrypted file system drives

  • Risking liability for unnecessary disruption of business

  • Creating bad reputation for heavy-handedness collecting unnecessary pieces of equipment.