Digital Evidence: Preservation and Basic Principles

• Response and investigation officers encountering digital evidence
• Student officers seeking an introduction to digital evidence principles
• Officers who need to secure a device at scene before the DFU can attend

1. 1

   Know the four ACPO principles

   The ACPO Good Practice Guide (now maintained by the NPCC) establishes four core principles. Principle 1: No action taken by investigators should change data on digital devices. Principle 2: Where it is necessary to access original data, the person doing so must be competent and able to explain their actions. Principle 3: An audit trail of all processes applied must be created and preserved. Principle 4: The person in charge is responsible for ensuring the law and these principles are adhered to.

2. 2

   Preserve before you examine

   Your first obligation is to preserve. Before doing anything else: document the device state (on or off, battery level), photograph it in situ, and do not attempt to access the device unless you are competent and have authority to do so. Switching on a device that is off, or unlocking a locked device, can alter metadata and compromise evidential integrity.

3. 3

   Seizure decisions

   A device may be seized under a search warrant, under s.19 PACE (general power to seize evidence at scene of a search), or with the consent of the owner. The basis for seizure must be documented. Contact your DFU if you are unsure whether a device falls within the scope of a warrant or what your seizure powers are in specific circumstances.

4. 4

   Do not attempt forensic examination without specialist training

   Unless you have completed your force approved digital evidence training, do not attempt to extract data from devices. This includes: browsing a suspect phone without proper processes, connecting devices to your own equipment, or attempting to mirror a device. These actions can destroy evidence and undermine prosecution.

5. 5

   Maintain chain of custody

   Every person who handles a seized device must be documented. Package devices in appropriate bags (anti-static for electronic devices), seal with tamper-evident seals, label with exhibit reference, and complete the continuity documentation. Note the device state at each handover.

6. 6

   Defer to your DFU for anything complex

   Your force Digital Forensics Unit (DFU) or Computer Crime Unit exists to handle complex digital evidence. When in doubt — about seizure scope, about what data may be held, about how to access a specific device type — contact them before taking action. They would rather advise you in advance than remediate an inadvertent error.

• Switching on a powered-off device at scene to check what is on it
• Charging a device found with low battery without DFU advice — this can alter data
• Attempting to access a locked phone without proper authority and process
• Browsing photos or messages on a device at scene rather than seizing and submitting for examination
• Failing to document who has had custody of a device at each stage

Contact your DFU immediately if: you encounter a device that is on and displaying relevant material, you are unsure whether a device is within the scope of your search authority, or you find devices that may require specialist tools to access.