Forensics: Crime Scene Detective — Tutorial 1: Cold Storage

Tutorial 1: Cold Storage introduces digital forensics — the foundation for many later cases. You investigate a drug dealer's flat and must locate, photograph, collect, and analyze digital devices. This walkthrough covers every step from the LKA laboratory to the final lab analysis.

Case Briefing

Jane Doe reports that a drug dealer has been caught at his flat. Any digital devices may have been used to communicate with clients and must be collected for forensic analysis. Your objectives: locate all devices, photograph them in situ, collect them properly, and analyze them in the laboratory.

Crime Scene Steps

1. Travel to the crime scene by pressing E when prompted at the filing cabinet.
2. Open the case file (Tab) and review witness statements.
3. Pick up evidence markers from the tool case.
4. Search the flat for smartphones, computers, and storage media.
5. Place a marker next to each digital device before touching it.
6. Photograph each marked device — the marker must be visible in the photo.
7. Inspect each device for condition status (functional, encrypted, damaged).
8. Collect devices and place them in appropriate evidence containers.

Laboratory Analysis

Back at the LKA lab, interact with the digital forensics workstation. For functional devices, short-press E to select, optionally enter a password found at the scene, then long-press E to start analysis. For damaged devices, use the chip extraction bench: heat the chip evenly, vacuum it off the board, and transfer to the analysis system.

Decryption Workflow

• Select a functional device at the decryption module.
• If encrypted, search the crime scene for password clues (notes, sticky pads, trash).
• Short-press E to select device, long-press E to begin decryption.
• Export results to a folder and pick up the report.
• Read the report for call logs, messaging history, and deleted data.

Chip Extraction

• Place damaged device on the desoldering station.
• Long-press E to start heating.
• Heat evenly around the chip perimeter — overheating destroys data permanently.
• Vacuum the chip once it releases.
• Transfer extracted chip to the analysis reader.

Completing the Tutorial

Submit analyzed evidence via the lab email system. Attach evidence files and send to colleagues for evaluation. Once all devices are processed and reports reviewed, close the case from the filing cabinet. Aim for zero undiscovered leads by checking every room including storage areas.