A device with a network interface but not connected at the time is treated as stand-alone, but the DEFR looks for devices it may recently have been connected to and, if recent disconnection is suspected, considers treating it as networked so the rest of the network is handled correctly. Storage media of many kinds (portable drives, flash drives, optical discs, floppies, tapes, memory cards) are expected. Once the scene and personnel safety steps of clause 6.2 are done, the DEFR at least: records the type and make of devices and identifies all computers and peripherals that may need taking, with serial and licence numbers and other marks including damage; leaves power states as found (never switching on or off); photographs or describes what is on running screens (window positions, titles, contents); keeps battery devices charged and gathers chargers and cables; and considers a wireless signal detector for hidden wireless devices, recording when one is not used for cost or time reasons, continuing under 7.2.2.2 if networked devices are found, and keeping active scanners off until it is known how they may interact with devices present, since scanning can be detected and may trigger destruction of evidence or concealed traps. Where local law allows devices to be switched on to judge relevance, thorough notes are kept; power state decisions follow the volatility and relevance ranking (pull the plug after photographing the screen if disk data matters most, keep it running if memory matters).
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.