Prepare desktop computer

1. Remove all media and devices (e.g., CDs, DVDs, digital media player)
2. Turn off all attached devices
3. Turn off desktop computer
4. Disconnect all power cords from electrical outlets
5. Disconnect all power cords, I/O cables, and any other cables connected to the desktop computer
6. Remove any locking device that secures the side panel of the desktop computer
7. Optional step: review manufacturer documentation on removing the internal hard drive

Prepare temporary evidence storage area

1. Obtain small empty plastic container from digital forensics lab supply area
2. Label plastic container with:
   1. Accession ID 
   2. Evidence ID
   3. Name of examiner
   4. Date
3. Obtain polypropylene sleeve from digital forensics lab supply area
4. Place polypropylene sleeve inside plastic container
5. Place plastic container in temporary evidence storage area near forensic workstation

Remove side panel from computer tower

1. Remove two screws that secure side panel and place in plastic container
2. Press the cover-release button on the side panel
3. Slide side panel to the rear of the computer to remove the panel
4. Place piece of painter’s tape on side panel
5. Write Evidence ID on tape
6. Place side panel in evidence storage area

Examine hard drive cables

1. Locate each end of the power supply cable
2. Locate each end of the  SATA cable

Detach cables from hard drive

1. Detach power supply cable
2. Detach SATA cable
3. Leave power supply and SATA cables attached to motherboard

Remove cooling fan