What items should be included in a jump bag? How often do you review your jump bag?

  • 1
    This article can be a good start. Dec 2, 2010 at 8:07
  • Oh man I wish there was some good answers to this question :)
    – Chris Dale
    Dec 6, 2010 at 11:15
  • I really wish there had been some more answers. I almost started a bounty.
    – sdanelson
    Dec 7, 2010 at 1:01
  • 2
    Useful related links to similar questions on Security Stack Exchange as these should be considered together - Network Forensics tools - Computer Forensics tools
    – Rory Alsop
    Dec 14, 2010 at 22:42
  • @sdanelson The link for jump bag is broken
    – Squidly
    Oct 5, 2015 at 14:58

1 Answer 1


Often we use field visits for information gathering and/or equipment seizing. So a lot of the papers and cheatsheats will be left back in the lab. We also have an old laptop set up that is kept on the shelf, but used entirely for field work. It is, however, not normally kept in the jump bag.

My bag specifically contains:

  • Several Network Cables (straight through, loopback)
  • Serial cable with serial->USB adapter
  • Juniper and Cisco serial adapters
  • Hard drives (various sizes)
  • Flash drive
  • Backtrack LiveDVD
  • Logicube-MD5 (portable drive duplicator with write-blocker)
  • Various drive interface adapters
  • Handheld label printer
  • 4 port hub
  • Digital camera
  • Cable ties
  • Cable snips
  • Assorted screw and hex drivers
  • Notebooks and pens
  • Chain of Custody forms
  • Incident Handling Procedure
  • Business cards for all members of the team

We will also grab any other oddities as necessary for specific cases not covered above.

A review of the bag contents doesn't happen often enough. There is typically a spot check at each use, though this is largely to determine if there are any unusual items needed for this specific event. In practice, the contents get reviewed along with the rest of the lab at year end when we do equipment refresh.

  • Do you review it on a scheduled basis? If yes, how often?
    – sdanelson
    Dec 10, 2010 at 14:34
  • Edited the answer to add that as well.
    – Scott Pack
    Dec 10, 2010 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .