→
The purpose
Assemble your kit so everything you need is in one place — this cuts the time to get started. The items must stay in the bag in peace-time, or it loses its value exactly when you need it. It also holds printed documentation: contingency plans, contact info for vital partners, and incident-handling procedures.
→
Contents
No fixed list exists — this is what the author wants in the bag.
- Pen & paper — the most overlooked yet most important; for notes, times and who you spoke to.
- Printed contingency plans, partner contacts, incident procedures.
- Hard drives (various sizes) and USB keys for copying/handing over data.
- Tool set (ideally with a magnetic tray / iFixit lid), antistatic bracelet, multitool, headlamp.
- Write protection — USB with CAINE Linux, plus hardware or software write-blocker.
- A computer, preferably Linux, for dealing with malware; optionally one with the company image to test AV definitions. Remember the power supply!
- Water and food (muesli bar) — not trivial on multi-hour jobs; personal items like deodorant/toothbrush.
- Cables: network, USB (A→micro/C), USB→SATA, SSD/NVMe/M.2 adapters; multi-format card reader.
- Optionally a small router + switch for a separate network (GL.iNet routers work well, with VPN).
- A camera (often the phone) for documentation.
→
Worth considering
- Power bank, spare SD card, noise-isolating headphones, USB drive with write-block option (Kanguru / Netac).
→
Maintenance
None of this is worth much if it is not reviewed and updated. Keep control of the bag and its documents — make a checklist of what belongs in it so it is easy to maintain.
A locked-off room is a must: it removes the analyst from prying eyes and reduces a real stress factor. Remember colleagues or suspects are innocent until proven otherwise.