Proper Handling of Electronic Evidence

No matter what the crime, almost every criminal case in today’s world will have some kind of electronic evidence belonging to the suspect or suspects that will need examining. From compact discs (CDs) to external hard drives with multiple terabytes of storage, it is important that law enforcement officers understand the proper procedures for identifying and handling electronic evidence when conducting a criminal investigation. Being conscientious and diligent when handling electronic evidence may mean the difference between a successful prosecution of a dangerous criminal, a not guilty verdict, or the worst phrase in an officer’s view, “Case dismissed!”

First Things First…

The investigating officer must ensure before handling any electronic evidence that he or she has a right to examine or collect said evidence within the scope of the Fourth Amendment. For example, if the officer is serving a search warrant on a residence, does the search warrant specifically mention electronic storage devices? If not, the officer may not have the legal right to seize the evidence, and it is likely to be ruled inadmissible in court. If the officer does not have the legal right to seize electronic evidence (i.e. it is not mentioned on a warrant or the officer does not have probable cause that the electronic evidence contains contraband or evidence of a crime), the officer may elect to ask the suspect if they are willing to consent to a search of their electronic items. It is always best practice to get the suspect’s consent in writing and capture the agreement to give consent via audio and/or video recording. Keep in mind that these recordings become digital evidence, and specific handling should be applied thereafter.

Legal Authority

Once it has been determined that the investigating officer can legally collect electronic evidence for further examination, it is paramount that the officer follow a few basic rules when doing so. First, the officer will need to take still pictures or a video of the evidence where it was found as questions may arise as to the location of the electronic evidence later in the investigation. It is also important for the investigating officer to take still pictures or a video of how the items are set up (i.e. how are the wires at the back of the computer set up or how is the external hard drive plugged into the computer). Ask the suspect if there are any passwords or patterns associated with booting up the device, but remember that doing so may be considered an interrogation for purposes of Miranda rights. If a device is turned off, DO NOT turn the device on. Collect and transport the electronic evidence to an electronic evidence forensic specialist who will know how to power the electronic evidence on without corrupting the evidence. If the electronic evidence is on, leave the electronic evidence on and make attempts to have an electronic evidence forensic specialist join you at the scene of the investigation. If it is not possible to have a specialist meet you at the scene, collect all passwords or patterns you can and package the electronic evidence for transport.

Collection and Transport of Electronic Evidence

Here are a few simple practices when collecting and transporting electronic evidence can save investigating officers future headaches if implemented correctly. All cables and cords must be disconnected and kept with their respective device. It is best practice to store each individual piece of electronic evidence (i.e. desktop computer, laptop computer, hard drive), in its own electronic evidence bag or box for transport. Smaller electronic evidence items such as CDs/DVDs or thumb drives can be stored together, but always remember to record the brand name (if applicable) and amount of these items on the electronic evidence bag or box. Document the chain of custody in accordance with your agency’s policies and seal any electronic evidence bags or boxes while on scene. When transporting electronic evidence, it is important to store it in a place where it will not be damaged during travel, and where it will be protected from extreme heat or cold. DO NOT place electronic evidence anywhere near a police car radio unit. Activating the radio may potentially damage the electronic evidence. Take the most direct and/or logical route to a secure law enforcement facility or digital evidence laboratory for further examination.

Conclusions

Electronic devices as evidence have become so ubiquitous in our lives that most jobs, (including being an effective law enforcement officer) can’t be done without them. From mail fraud to murder and everything in between, nearly every single crime committed will have an electronic device involved that can be utilized by law enforcement to develop or further a case against a suspect. While it is always best practice to have a trained electronic evidence forensic specialist on scene when handling electronic evidence, reality dictates that law enforcement officers will not always have this luxury and will be called upon to handle electronic evidence on their own from time to time. An educated and attentive law enforcement officer who follows these basic guidelines should be successful in using electronic evidence to build or enhance a case against a suspect.