General Information
-
Case Number:
-
Date of Incident:
-
Location of Incident:
-
Reporting Officer/Investigator:
Device Information
-
Type of Device (e.g., smartphone, computer, tablet):
-
Make and Model:
-
Operating System:
-
Serial Number/Identifier:
-
User Account Information:
Incident Details
-
Description of the Incident
-
How was the device accessed? (e.g., physical access, remote access):
-
What specific data or evidence are you seeking?
-
Was any data intentionally deleted?
Timeline
-
When was the device last used?
-
When was the incident discovered?
-
Was the device turned off or in use during the incident?
Preservation of Evidence
-
Has the device been altered or tampered with since the incident?
-
Is there a backup of the data available
-
Was the device powered off or in a specific state during preservation?
Relevant Users
-
Who has access to the device?
-
Are there any other accounts linked to the device?
-
Have there been any recent changes to user permissions?
Communication and Activity
-
What applications were in use at the time of the incident?
-
Have there been any suspicious communications or transactions?
-
What social media accounts are linked to the device?
Additional Notes
-
Any other relevant information:
-
Any other relevant information:
-
Any other relevant information:
-
Any other relevant information:
