Collection of Digital and Electronic Evidence

Why Digital Evidence Demands Special Handling

Digital evidence is fragile in ways that physical evidence is not. A fingerprint does not disappear because a radio signal reached it. Electronic data can be overwritten, encrypted, remotely wiped, or corrupted by static electricity in seconds. The first responder's job is simple to state and difficult to execute: do not make things worse. Every action taken at the scene—or every action deliberately not taken—must be documented and defensible in court.

The Scientific Working Group on Digital Evidence (SWGDE) publishes best-practice guidelines that courts and agencies recognize. Familiarize yourself with these references early; the IAI CCSI exam and most state evidence-tech certifications expect you to know the principles behind them.

The Wireless-Signal Threat and Faraday Bags

A powered-on mobile phone is in constant contact with cell towers, Wi-Fi access points, and Bluetooth devices. A remote-wipe command can arrive over any of those channels and erase the entire device in moments. The solution is isolation: place the powered-on phone into a Faraday bag before you do anything else.

A Faraday bag is lined with a metallic mesh that blocks electromagnetic signals. Once the phone is inside and the bag is sealed, no signal can enter or leave. The phone remains powered on—its current state, open apps, and unencrypted data are preserved—but it is cut off from the network.

Procedure for a powered-on phone:

1. Photograph the screen in place before touching the device.

2. Note the battery level if visible; a dead battery ends isolation.

3. Slide the device into the appropriately sized Faraday bag without pressing any buttons.

4. Seal the bag completely.

5. Complete the evidence label immediately: case number, item number, date, time, location found, collector's name.

6. Document in your notes that the device was placed in a Faraday bag and the reason.

Do not power the phone off unless a qualified digital examiner instructs you to. Powering a device off can trigger encryption, delete data held only in RAM, or require a passcode to re-enter—locking examiners out.

Computers and the Powered-On Dilemma

Finding a computer powered on at a scene is one of the most consequential decisions a first responder faces. The general first-responder rule is: photograph everything, touch nothing, call for help.

• Photograph the screen exactly as found. Use a camera, not your phone, to avoid accidental interaction.
• Do not touch the keyboard or mouse. Movement can activate a screensaver, trigger encryption, or overwrite swap files.
• Document all connected peripherals: monitors, external drives, USB devices, cables, network connections. Photograph each connection before anything is moved.
• Note whether the machine is connected to a network. If the scene allows, a digital examiner may choose to pull network cables—not power cables—to prevent remote access while preserving the running state.
• Contact a digital forensic examiner before proceeding. The decision to perform a live acquisition or power down belongs to a trained examiner, not the first responder.

If the device is powered off, do not turn it on. Booting a computer can alter timestamps, overwrite deleted-file space, and run startup scripts. Leave it off and package it.

Anti-Static Packaging for Storage Media

USB drives, SD cards, external hard drives, and circuit boards are vulnerable to electrostatic discharge (ESD). A static spark invisible to the human eye can destroy data or physically damage components. Use anti-static bags (typically translucent pink or silver) for all storage media. Do not use ordinary plastic bags or paper envelopes for bare media.

Packaging steps for storage media:

1. Place the item in an anti-static bag.

2. Seal the bag.

3. Place the sealed bag inside a rigid evidence container if the item is fragile.

4. Label the outer container with the same information required for any evidence item.

Chain of Custody for Digital Items

Every person who handles digital evidence must be recorded. The chain of custody form for a digital item must include: item description (make, model, serial number, and any visible identifiers), condition at collection, packaging method, and each transfer of custody with date, time, and signature. Courts have excluded digital evidence when chain-of-custody records had gaps, so completeness is not optional.

Safety Considerations

• Wear nitrile gloves at all times; skin oils can damage optical media and may smear latent prints on device surfaces that still need processing.
• If a device appears damaged, swollen, or smells of burning, do not handle it. A swollen lithium-ion battery is a fire hazard. Notify your supervisor and follow your agency's hazmat protocol.
• Never place a powered-on device in a sealed metal evidence can without confirming it is a Faraday-shielded container; an ordinary can will not block signals and may trap heat, accelerating battery failure.
• Follow your agency's lockout/tagout equivalent for digital evidence: no one accesses the device after packaging without documented authorization and a supervisor's sign-off.

Connecting to Your Credentials

The IAI CCSI and State Evidence Tech Cert both test your knowledge of proper evidence handling, including digital items. Examiners look for understanding of why each step matters, not just rote procedure. Be prepared to explain, in plain language, why you sealed the bag before writing the label, or why you did not power off the laptop.