Chapter 23: Digital Evidence Handling Guidelines

Overview

Technology is advancing at such a rapid rate that the suggestions in this guide must be examined through the prism of current technology and the practices adjusted as appropriate. It is recognized that all crime scenes are unique and the judgment of the first responder/investigator should be given deference in the implementation of this guide. (USDOJ (2001), "Electronic Crime Scene Investigation: A Guide for First Responders")

This chapter provides guidelines for handling digital evidence, summarizing the detailed discussion in Chapter 9. The primary aim of this chapter is to assist in the development of procedures and crime scene protocol that minimize the chance of injury and contamination of evidence. Keep in mind that a procedure cannot cover all eventualities and individuals handling digital evidence may need to deal with unforeseeable situations. Therefore, all individuals handling evidence should have sufficient training and experience to implement procedures and deal with situations that are not covered by procedures.

In addition to developing procedures, it is advisable to equip individuals who are handling digital evidence with items such as tools and surgical gloves. Using proper tools reduces the risk of injury such as deep cuts when too small a screwdriver slips on a tight screw, causing one's hand to hit sharp metal edges inside the computer. Surgical gloves help preserve fingerprints and other trace evidence, while protecting individuals from hazardous materials. Some crime scenes, such as drug laboratories, may require additional protection.

Prior to handling digital evidence, the crime scene should be secured, preventing anyone from touching the computer and associated items. Make an effort to prevent anyone from accessing the system via a wireless connection (e.g. infrared or bluetooth). Also, take notes that will be useful when reconstructing the scene and draw diagrams with the overall dimensions to get an overview of the scene and make it easier to remember and explain where things were found. Assign each room a letter and each source of digital evidence a number to keep track of the items. Although authorization is presumed, it is worth reiterating that a warrant or other authorization should be obtained prior to implementing these guidelines.