Which of the following is not correct when documenting an electronic crime scene?

Which of the following is not correct when documenting an electronic crime scene?

• A. Document the physical scene, such as the position of the mouse and the location of components near the system
• B. Document related electronic components that are difficult to find
• C. Record the condition of the computer system, storage media, electronic devices and conventional evidence, including power status of the computer
• D. Write down the color of shirt and pant the suspect was wearing

Answer: (D)

Documenting an electronic crime scene focuses on details that affect digital evidence and how it can be recovered, preserved, and reconstructed. This means noting the physical arrangement of the scene in relation to the devices, all related electronic components that could influence evidence collection, and the condition of the equipment itself—including whether systems and storage media are powered on, off, or in a particular state. These specifics help determine data susceptibility, the order of imaging, and how evidence might have been created or manipulated. Describing the color of the suspect’s clothing does not contribute to understanding or preserving electronic evidence. It’s not relevant to the integrity of digital artifacts, to the imaging process, or to the reconstruction of events tied to the electronic components involved. While clothing details might appear in a broader crime scene photo log, they are not part of documenting the electronic evidence and its handling. Therefore, the appropriate documentation focuses on the physical setup around the devices, the related components that could be overlooked, and the exact condition and power state of the computer and media. The clothing description, while possibly useful for general scene photography, does not fit the purpose of electronic crime scene documentation.

Documenting an electronic crime scene focuses on details that affect digital evidence and how it can be recovered, preserved, and reconstructed. This means noting the physical arrangement of the scene in relation to the devices, all related electronic components that could influence evidence collection, and the condition of the equipment itself—including whether systems and storage media are powered on, off, or in a particular state. These specifics help determine data susceptibility, the order of imaging, and how evidence might have been created or manipulated.

Describing the color of the suspect’s clothing does not contribute to understanding or preserving electronic evidence. It’s not relevant to the integrity of digital artifacts, to the imaging process, or to the reconstruction of events tied to the electronic components involved. While clothing details might appear in a broader crime scene photo log, they are not part of documenting the electronic evidence and its handling.

Therefore, the appropriate documentation focuses on the physical setup around the devices, the related components that could be overlooked, and the exact condition and power state of the computer and media. The clothing description, while possibly useful for general scene photography, does not fit the purpose of electronic crime scene documentation.