Storage Procedures of Digital Evidence
When storing digital evidence should:
- Ensure that the digital evidence is inventoried in accordance with the agency’s policies.
- Ensure that the digital evidence is stored in a secure, climate-controlled environment or a location that is not subject to extreme temperature or humidity.
- Ensure that the digital evidence is not exposed to magnetic fields, moisture, dust, vibration, or any other elements that may damage or destroy it.
NOTE: Potentially valuable digital evidence including dates, times, and system configuration settings may be lost due to prolonged storage if the batteries or power source that preserve this information fails. Where applicable, inform the evidence custodian and the forensic examiner that electronic devices are battery powered and require prompt attention to preserve the data stored in them.
If more than one computer is seized as evidence, all computers, cables, and devices connected to them should be properly labeled to facilitate reassembly if necessary. In this example, the computer is designated as computer A. All connections and cables are marked with an “A” and a unique number.
Subsequently seized computers can be labeled in alphabetical order. The corresponding connections and cables can be labeled with the letter designation for the computer and a unique number to ensure proper reassembly.