As a computer investigator for your local sheriff’s department, you have been asked to go with a detective to a local school that received a bomb threat in an anonymous email. The detective already has information from a subpoena sent to the last known ISP where the anonymous email originated, and the message was sent from a residence in the school’s neighborhood. The detective tells you the school principal also stated that the school’s Web server has been defaced by an unknown computer attacker. The detective has just obtained a warrant for the search and seizure of a computer at the residence the ISP identified. Prepare a list of what items should be included in an initial-response field kit to ensure the preservation of computer evidence when the warrant is carried out.
