• Model number or serial number—List the model number or serial number (if available)
of the computer component. Many computer components, including hard drives,
memory chips, and expansion slot cards, have model numbers but not serial numbers.
• Evidence recovered by—The name of the investigator who recovered the evidence.
The chain of custody for evidence starts with this information. If you insert your
name, for example, you’re declaring that you have taken control of the evidence. It’s
now your responsibility to ensure that nothing damages the evidence and no one
tampers with it. The person placing his or her name on this line is responsible for
preserving, transporting, and securing the evidence.
• Date and time—The date and time the evidence was taken into custody. This information
establishes exactly when the chain of custody starts.
• Evidence placed in locker—Specifies which approved secure container is used to store
evidence and when the evidence was placed in the container.
• Item #/Evidence processed by/Disposition of evidence/Date/Time—When you or
another authorized investigator retrieves evidence from the evidence locker for
processing and analysis, list the item number and your name, and then describe
what was done to the evidence.
• Page—The forms used to catalog all evidence for each location should have page
numbers. List the page number, and indicate the total number of pages for this group
of evidence. For example, if you collected 15 pieces of evidence at one location and
your form has only 10 lines, you need to fill out two multi-evidence forms. The first
form is noted as “Page 1 of 2,” and the second page is noted as “Page 2 of 2.”