What should be included in a jump bag and how often should it be reviewed?

Question

What items should be included in a jump bag? How often do you review your jump bag?

Answer 1

Often we use field visits for information gathering and/or equipment seizing. So a lot of the papers and cheatsheats will be left back in the lab. We also have an old laptop set up that is kept on the shelf, but used entirely for field work. It is, however, not normally kept in the jump bag.

My bag specifically contains:

• Several Network Cables (straight through, loopback)
• Serial cable with serial->USB adapter
• Juniper and Cisco serial adapters
• Hard drives (various sizes)
• Flash drive
• Backtrack LiveDVD
• Logicube-MD5 (portable drive duplicator with write-blocker)
• Various drive interface adapters
• Handheld label printer
• 4 port hub
• Digital camera
• Cable ties
• Cable snips
• Assorted screw and hex drivers
• Notebooks and pens
• Chain of Custody forms
• Incident Handling Procedure
• Business cards for all members of the team

We will also grab any other oddities as necessary for specific cases not covered above.

A review of the bag contents doesn't happen often enough. There is typically a spot check at each use, though this is largely to determine if there are any unusual items needed for this specific event. In practice, the contents get reviewed along with the rest of the lab at year end when we do equipment refresh.