secure the computer as evidence

Photograph and log room, position of computer and status of computer;
If the computer is “OFF,” Do Not Turn “ON”;
If the computer is “ON,” Do Not Turn “OFF”;
Place Evidence tape over each drive slot;
Photograph and label back of computer components while they are plugged in;
Label all connection ends to allow reassembly if needed;
If transporting, treat all components as fragile;
Collect all devices such as cables, keyboards and monitors;
Collect instruction manuals, documentation, and notes;
User notes may contain passwords;