01Purpose and scope
To bring digital devices from the place they are found to the laboratory with their evidential value intact and their handling fully documented.
Applies to computers, servers, phones, tablets, storage media, network equipment, cameras and other devices encountered during an authorised seizure or an internal incident. It covers the period from arrival at the scene to hand-over at intake.
02Prerequisites
- Written authority defining what may be seized, whether on-site imaging is permitted and whether passwords may be requested.
- Kit: camera, labels, tamper-evident bags, anti-static bags, shielded (Faraday) bags with a power bank, write blocker, sterile storage, gloves, forms.
- A reference clock (synchronised phone or watch) whose source is noted.
03Steps
Secure the area
Keep people away from devices, keyboards, power switches and network equipment. Ask occupants not to use phones until devices are secured, to reduce the risk of remote wiping.
RecordTime of arrival, persons present, who secured what.
Photograph before touching
Overview of the room, each device in place, cable connections, screens as found. Include the reference clock in at least one photograph of each powered screen.
RecordPhoto numbers mapped to device labels.
Inventory every device
For each item: type, make, model, serial or IMEI, storage size if visible, state (on/off/locked/damaged), exact location, connections, any password or PIN found nearby. Assign a unique evidence number and label the item.
RecordEvidence intake form, one line per item.
Powered-on computers: decide and document
Do not switch off. Photograph the screen with date, time and time zone visible. If a destructive process is visibly running, cut power from the device end. Check for encryption indicators and network connections. If live collection is authorised and justified, follow SOP-06; otherwise isolate from the network and perform a documented shutdown, removing the power cable at the device.
RecordDecision, reason, time, who decided; every key pressed.
Powered-off computers
Do not switch on. Photograph and label all cables and ports. Remove the power cable from the device, not the wall. Check optical drives and card readers without powering on. Seal drive bays and ports.
RecordSeal numbers per item.
Mobile devices
If on, keep it on and isolate: airplane mode with Wi-Fi and Bluetooth off if the screen is accessible, otherwise a shielded bag with a power source inside. Photograph the screen and the displayed time. If off, leave it off. Seize chargers and cables. Record IMEI, SIM/ICCID and any memory card separately.
RecordIsolation method and time; power state at seizure.
Package and seal
Anti-static bags for media and boards; shielded bags for wireless devices; original packaging where available. Tamper-evident seals signed and dated across the opening. Keep paperwork separate from devices.
RecordSeal number, packer, time.
Open the chain of custody
Every item gets its first custody line at the scene: evidence number, description, collected by, time, from where. Each later hand-over adds a line with both signatures.
RecordChain of custody form started.
Transport
Protect from shock, heat, moisture and magnetic fields. Do not leave items unattended in vehicles. Deliver to intake with the forms.
RecordDeparture and arrival times; vehicle; carrier.
04Records produced
- Scene photographs indexed to evidence numbers
- Evidence intake form (one line per item)
- Chain of custody form with the first custody line
- Decision log for powered-on devices
05Pitfalls
- Pressing Enter or the power button to wake a screen can trigger a lock or shutdown; move the mouse or press Shift.
- A charging cable passing through a shielded bag acts as an antenna; the power source must be inside the bag.
- Removing the plug from the wall leaves a UPS powering the device; remove it at the device.
- Unlabelled cables and docks cannot be reconnected for examination; photograph connections before removal.