Networked devices may sometimes be left connected so a DEFR or DES with proper authority can monitor and record their activity; otherwise they are collected as follows. Isolate the device from the network (pull the cable from the phone line or network socket, or cut the link to the wireless access point) once sure no relevant data will be overwritten and no important system will fail (hospital facility systems, for example). Before unplugging, trace connections and label ports so the network can be rebuilt, and find every communication route (wired LAN, wireless modem, mobile cards, Wi-Fi, Bluetooth, mobile networks), protecting against destruction of evidence through each. Remember that removing power destroys volatile data such as running processes, connections and memory contents, and that the host operating system may report false information, so capture it first with trusted, verified methods and disconnect only once nothing will be lost. Keep a device with volatile memory powered where collection comes before acquisition. Package, seal and label a switched-off mobile so its keys cannot be pressed, considering Faraday or shielded boxes; switch some mobiles off on collection to stop data changing through incoming or outgoing connections or remote commands. Afterwards each device may be treated as stand-alone (7.1) until examined, when it is again considered networked. Removable media may have formed a network by hand (a sneakernet), so information on the other devices involved is sought.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.