What should be recorded about removable storage?¶
Record enough to distinguish the item, reconstruct where and how it was found, and explain every change in its custody or connected state. A description such as “USB stick” is not sufficient.
Identify the physical item¶
Record the media type, make, model, colour, stated capacity, serial number, asset tag, dimensions and all labels or markings. Photograph every side and its packaging. Note damage, contamination, signs of opening, activity lights, switches, write-protection tabs, cables, cases, adapters and proprietary connectors.
These features can differentiate otherwise similar items and connect the media with a host or normal use. Stated capacity and labels remain observations rather than proof of actual contents, ownership or origin.
Reconstruct context and handling¶
Document the exact location and position, nearby equipment and the person with possession or control. If connected, record the host, port, cable, account, power state, visible applications, prompts and transfers before any change. Note whether it was separately powered, locked or apparently encrypted.
Package the item to prevent loss, static or physical damage and accidental insertion. Keep associated components identifiable without allowing them to damage the media. The continuity record should name every person who handled, packaged, transported or examined it and give the time and purpose of each transfer.
Key takeaway
Describe removable storage as a unique physical item and preserve its discovery, connection and custody context so later examination findings can be tied reliably to the correct evidence.
