Print | E-mail

 

Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition

April 14, 2008

Chapter 6. Packaging, Transportation and Storage of Digital Evidence

Section 1 — Packaging Procedures

All actions related to the identification, collection, packaging, transportation, and storage of digital evidence should be thoroughly documented. When packing digital evidence for transportation, the first responder should—

• Ensure that all digital evidence collected is properly documented, labeled, marked, photographed, video recorded or sketched, and inventoried before it is packaged. All connections and connected devices should be labeled for easy reconfiguration of the system later.
• Remember that digital evidence may also contain latent, trace, or biological evidence and take the appropriate steps to preserve it. Digital evidence imaging should be done before latent, trace, or biological evidence processes are conducted on the evidence.
• Pack all digital evidence in antistatic packaging. Only paper bags and envelopes, cardboard boxes, and antistatic containers should be used for packaging digital evidence. Plastic materials should not be used when collecting digital evidence because plastic can produce or convey static electricity and allow humidity and condensation to develop, which may damage or destroy the evidence.
• Ensure that all digital evidence is packaged in a manner that will prevent it from being bent, scratched, or otherwise deformed.
• Label all containers used to package and store digital evidence clearly and properly.
• Leave cellular, mobile, or smart phone(s) in the power state (on or off) in which they were found.
• YIELD! Package mobile or smart phone(s) in signal-blocking material such as faraday isolation bags, radio frequency-shielding material, or aluminum foil to prevent data messages from being sent or received by the devices. (First responders should be aware that if inappropriately packaged, or removed from shielded packaging, the device may be able to send and receive data messages if in range of a communication signal.)
• Collect all power supplies and adapters for all electronic devices seized.