Digital Evidence Preservation
Checklist


Digital evidence can make or break a case– but you or your client can accidentally destroy, overwrite, or spoil it without realizing. Follow this handy checklist to preserve digital evidence from desktops, laptops, cell phones, and even “the cloud,” and ensure that it is available when you need it for your case.

Do:

  • Act quickly; time is of the essence
  • Call a trained digital forensic specialist right away
  • Cast a wide net. Preserve any and all digital evidence that you think may be useful down the road. Remember, preservation is relatively inexpensive, and you can decide later whether you want to analyze it.
  • Place a Preservation Order as soon as you think you may need data from a device, application or network that belongs to someone else If you have access to a device containing electronic evidence that you would like to preserve:
  • Take a photograph of the evidence (including front, back, etc.) as soon as possible so that you can document it’s condition
  • Physically store evidence securely in an access-controlled location, if it is in your or your client’s possession
  • Collect loose items (hard drives, memory cards, etc.) and place them in an evidence bag. Fill out a Chain of Custody form
  • Place items that connect wirelessly (cell phone, laptop, tablet) in a shielded evidence bag
  • Disconnect network cables from desktop computers

Don't:

  • Don’t turn the computer or smartphone OFF if it’s on
  • Don’t turn the computer or smartphone ON if it’s off
  • Don’t leave the device in an open area or other unsecured space
  • Don’t remove or plug in memory cards, USB thumb drives, or any other storage media
  • Don’t charge the device if it is not charged.
  • Don’t leave wireless devices or cell phones in an area where they could get cellular or wireless signal
  • Don’t click on files, view photos or open applications
  • Don’t copy files to or from the smartphone or computer
  • Don’t let anyone without forensic training investigate or view files on the original device
  • Above all, don’t wait to preserve evidence!
Request a Quote

LMG: We Make Your Hard-to-Get Evidence Easy to Understand.