Seizure, packaging and transport

Once the scene is secure and documented, items are either taken into custody or their data is copied on site. Either way, the evidence must reach the laboratory in the condition in which it was found, and anyone must be able to see that it has not been opened or swapped on the way. This lesson covers the choice between seizing and copying, labeling, packaging, sealing and transport. How copies are made is covered in Module 4, and how transfers are recorded in Module 5.

Seize the item or copy the data

Taking a device into custody gives the examiner the original, time and a controlled environment. Copying on site, which is acquisition (Module 4), is sometimes the only option and sometimes the better one.

• Seize when the device is portable, the authorization allows it, the examination will take time, or the device itself matters, for example to examine a phone's hardware or to show who possessed it.
• Copy on site when the system cannot be removed or stopped, such as a business server or a storage array; when data is encrypted and readable only while the system runs; when taking the hardware would be disproportionate (Module 2); or when the data sits in a cloud service.

Some cases need both: a live copy of memory and of an unlocked volume, followed by seizure of the device.

Labeling and tagging

Every item gets a unique exhibit number that follows it through every record and report. Many organizations combine the case reference, the collector's initials and a sequence number. Parts that can be separated, such as a laptop, its charger and a memory card found inside it, each get their own number and are recorded as related.

• Photograph each item with its label visible before it is packaged.
• Attach labels to the packaging or with tie-on tags, and do not cover serial numbers, ports or screws on the device itself.
• Enter the exhibit number, a description, where it was found, the date and time, and who seized it in the exhibit list.

Packaging

Packaging protects items from physical damage, static electricity, radio signals and tampering.

• Anti-static bags protect bare drives, memory modules and circuit boards from electrostatic discharge, which can damage components. Ordinary plastic bags can build up static and are avoided for bare electronics.
• Rigid boxes with padding protect against crushing and shock. Hard disk drives, which have moving parts, are especially sensitive to impact.
• Paper bags or envelopes suit items that may be damp, because sealed plastic can trap moisture.
• Faraday bags (RF-shielding bags) block mobile, Wi-Fi and Bluetooth signals to and from phones, tablets and wearables.

Faraday bags and battery drain

A phone in a shielding bag keeps searching for a network, which usually drains its battery faster than normal. If the battery runs out the phone switches off, and when it starts again much of its data may stay encrypted until the passcode is entered. Keep isolated phones charged, with a power bank inside the bag or a bag with a shielded charging port; a charging cable passed through the bag's opening can carry signals in and defeat the shielding. Open the bag only inside a shielded box or room, or the phone will reconnect. Test bags from time to time, for example by calling a test phone placed inside.

Sealing

Each package is closed with tamper-evident tape, and the person who seals it signs and dates across the seal, so that the signature runs over both the tape and the package. Any later attempt to open it tears the tape or breaks the line of the signature. When an examiner opens the package later, they cut it open away from the original seal, record the opening, and reseal it with new tape and a new signature, so the whole history stays visible.

Cables, chargers and power adapters

Seize the chargers and power adapters that belong to seized devices. Phones and laptops may use proprietary connectors, and a phone kept in a shielding bag will need power within hours. External drives and NAS devices may need their own power supply to be read, and docking stations, special cables and hardware security keys may be needed later to reach the data. Each accessory gets its own exhibit number, linked to the device it belongs to.

Transport

• Keep items away from heat, such as a car parked in the sun, and from cold that can cause condensation when they are brought indoors.
• Keep them away from strong magnets, such as those in large loudspeakers, which can damage magnetic media.
• Protect them from moisture, vibration and shock, and secure boxes so they cannot slide or fall.
• Do not leave evidence unattended in a vehicle; take it directly to secure storage.
• Record every transfer between people or places, with date, time and signatures, in the chain of custody record (Module 5).

A data center server versus a personal laptop

Two seizures in the same fictional case show the contrast. At the suspect's home, the personal laptop is switched off. The team photographs it, labels it and its charger, packs it in a padded box, seals it and takes it away.

At the suspect's employer, the relevant data sits on a virtual machine in a data center, on a storage array shared by dozens of systems that must keep running. Taking the hardware is neither possible nor proportionate. Instead, with the system administrators' help and within the agreed scope, a specialist acquires the virtual machine's disk files and the relevant logs on site (Module 4), records hash values for each copy, notes who did what at each step, and documents the configuration: virtualization platform, storage layout and time settings. If physical disks from a RAID array ever have to be removed, their slot positions are labeled, because the array may not be rebuilt correctly without that order. The copies, not the server, are then packaged and transported.

Packaging by device type

Exam focus: Know when to seize an item and when to copy data on site, how exhibit numbers and labels are assigned, and which packaging suits each device: anti-static bags for drives, padded rigid boxes, paper for damp items, Faraday bags for phones. Expect questions on the battery-drain side effect of Faraday bags and how to keep phones charged without breaking the shielding, on signing across tamper-evident seals, on transport hazards (heat, magnets, moisture, shock, unattended vehicles), and on servers that are acquired on site rather than seized.