Prepare desktop computer

1. Remove all media and devices (e.g., CDs, DVDs, digital media player).
   
   
2. Turn off all attached devices.
   
   
3. Turn off desktop computer.
   
   
4. Disconnect all power cords from electrical outlets.
   
   
5. Disconnect all power cords, I/O cables, and any other cables connected to the desktop computer.
   
   
6. Remove any locking device that secures the side panel of the desktop computer.
   
   
7. Optional step: review manufacturer documentation on removing the internal hard drive.

Prepare temporary evidence storage area

1. Obtain small empty plastic container from digital forensics lab supply area.
   
   
2. Label plastic container with:
   
   
   1. Accession ID 
   2. Evidence ID
   3. Name of examiner
   4. Date
      
      
3. Obtain polypropylene sleeve from digital forensics lab supply area.
   
   
4. Place polypropylene sleeve inside plastic container.
   
   
5. Place plastic container in temporary evidence storage area near forensic workstation.

Remove side panel from computer tower

1. Remove two screws that secure side panel and place in plastic container.
   
   
2. Press the cover-release button on the side panel.
   
   
3. Slide side panel to the rear of the computer to remove the panel.
   
   
4. Place piece of painter’s tape on side panel.
   
   
5. Write Evidence ID on tape.
   
   
6. Place side panel in evidence storage area.

Examine hard drive cables

1. Locate each end of the power supply cable.
   
   
2. Locate each end of the  SATA cable.

Detach cables from hard drive

1. Detach power supply cable.
   
   
2. Detach SATA cable.
   
   
3. Leave power supply and SATA cables attached to motherboard.

Remove cooling fan

1. Remove four cooling fan screws and place in plastic container.
   
   
2. Leave cooling fan connected to motherboard.

Remove hard drive

1. Move cooling fan below the hard drive enclosure.
   
   
2. Use blue plastic handle to pull hard drive out of enclosure.

Remove plastic hard drive handle

1. Remove plastic hard drive handle.
   
   
   
   
2. Store handle and all screws in polypropylene bag.

Next steps

1.Update Register of Digital Media Carrier with information about hard drive:

a)Manufacturer

b)Maximum storage

c)Physical details

d)Serial number

2.Notify Digital Forensics Lab Manager that hard drive has been successfully extracted from the Lenovo ThinkCentre M58 desktop computer

3.See lab procedures PR-03 if approval is granted to proceed with forensic imaging