Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What items should be included in a jump bag? How often do you review your jump bag?

share|improve this question
This article can be a good start. – Nicolas NOEL Dec 2 '10 at 8:07
Oh man I wish there was some good answers to this question :) – Chris Dale Dec 6 '10 at 11:15
I really wish there had been some more answers. I almost started a bounty. – sdanelson Dec 7 '10 at 1:01
Useful related links to similar questions on Security Stack Exchange as these should be considered together - Network Forensics tools - Computer Forensics tools – Rory Alsop Dec 14 '10 at 22:42
@sdanelson The link for jump bag is broken – Squidly Oct 5 '15 at 14:58

Often we use field visits for information gathering and/or equipment seizing. So a lot of the papers and cheatsheats will be left back in the lab. We also have an old laptop set up that is kept on the shelf, but used entirely for field work. It is, however, not normally kept in the jump bag.

My bag specifically contains:

  • Several Network Cables (straight through, loopback)
  • Serial cable with serial->USB adapter
  • Juniper and Cisco serial adapters
  • Hard drives (various sizes)
  • Flash drive
  • Backtrack LiveDVD
  • Logicube-MD5 (portable drive duplicator with write-blocker)
  • Various drive interface adapters
  • Handheld label printer
  • 4 port hub
  • Digital camera
  • Cable ties
  • Cable snips
  • Assorted screw and hex drivers
  • Notebooks and pens
  • Chain of Custody forms
  • Incident Handling Procedure
  • Business cards for all members of the team

We will also grab any other oddities as necessary for specific cases not covered above.

A review of the bag contents doesn't happen often enough. There is typically a spot check at each use, though this is largely to determine if there are any unusual items needed for this specific event. In practice, the contents get reviewed along with the rest of the lab at year end when we do equipment refresh.

share|improve this answer
Do you review it on a scheduled basis? If yes, how often? – sdanelson Dec 10 '10 at 14:34
Edited the answer to add that as well. – Scott Pack Dec 10 '10 at 14:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.