Policy Text
Policy
811Fremont Police Department
Computers and Digital Evidence
811.1 PURPOSE AND SCOPE
This policy establishes procedures for the seizure and storage of computers, personal
communications devices (PCDs) digital cameras, digital recorders and other electronic devices
that are capable of storing digital information; and for the preservation and storage of digital
evidence. All evidence seized and/or processed pursuant to this policy shall be done so in
compliance with clearly established Fourth Amendment and search and seizure provisions.
811.2 SEIZING COMPUTERS AND RELATED EVIDENCE
Computer equipment requires specialized training and handling to preserve its value as evidence.
Officers should be aware of the potential to destroy information through careless or improper
handling, and utilize the most knowledgeable available resources. When seizing a computer and
accessories the following steps should be taken:
(a)Photograph each item, front and back, specifically including cable connections to other
items. Look for a phone line or cable to a modem for Internet access.
(b)Do not overlook the possibility of the presence of physical evidence on and around
the hardware relevant to the particular investigation such as fingerprints, biological or
trace evidence, and/or documents.
(c)If the computer is off, do not turn it on.
(d)If the computer is on, do not shut it down normally and do not click on anything or
examine any files.
1.Photograph the screen, if possible, and note any programs or windows that
appear to be open and running.
2.Disconnect the power cable from the back of the computer box or if a portable
notebook style, disconnect any power cable from the case and remove the
battery).
(e)Label each item with case number, evidence sheet number, and item number.
(f)Handle and transport the computer and storage media (e.g., tape, discs, memory
cards, flash memory, external drives) with care so that potential evidence is not lost.
(g)Log all computer items in the Property Room. Do not store computers where normal
room temperature and humidity is not maintained.
(h)At minimum, officers should document the following in related reports:
1.Where the computer was located and whether or not it was in operation.
2.Who was using it at the time.
3.Who claimed ownership.
Copyright Lexipol, LLC 2025/02/06, All Rights Reserved.
Published with permission by Fremont Police DepartmentComputers and Digital Evidence - 1
Fremont Police Department
Computers and Digital Evidence
4.If it can be determined, how it was being used.
5.The login, email, or other passwords being used by the suspect/user.
6.How the computer powered down if found running.
7.The devices that were attached to the computer.
8.Were there any non-forensic searches conducted on the computer/digital
storage device by Officers. Non-forensic searches should not be conducted, but
there may be situations, in which Officers find there is an immediate investigative
need for the search and there are no forensic tools at their disposal. Should
this situation arise, the searching Officer will provide a detailed reporting of files,
folders, software programs, and web sites accessed.
(i)In most cases when a computer is involved in criminal acts and is in the possession of
the suspect, the computer itself and all storage devices (hard drives, tape drives, and
disk drives) should be seized along with all media. Accessories (printers, monitors,
mouse, scanner, keyboard, cables, software and manuals) should not be seized
unless as a precursor to forfeiture or they have been used to perform a specific criminal
function (e.g.- scanners, printers, card readers, etc. used in forgery cases).
811.2.1 BUSINESS OR NETWORKED COMPUTERS
If the computer belongs to a business or is part of a network, it may not be feasible to seize the
entire computer. Cases involving networks require specialized handling. Officers should contact a
certified forensic computer examiner for instructions or a response to the scene. It may be possible
to perform an on-site inspection, or to image the hard drive only of the involved computer. This
should only be done by someone specifically trained in processing computers for evidence. In
investigations that lead to searches for digital evidence, it is recommended that Officers contact
a certified forensic computer examiner prior to the search.
811.2.2 FORENSIC EXAMINATION OF COMPUTERS
If an examination of the contents of the computer's hard drive, or floppy disks, compact discs,
USB drives or any other storage media is required, complete a digital evidence request form (form
PD-172/kb 7/08) and forward the following items to a computer forensic examiner:
(a)Copy of the complete report(s) involving the computer and digital storage media,
including the Evidence/Property sheet.
(b)Copy of a consent to search form signed by the computer or digital storage media
owner or the person in possession of the computer or digital storage media, or a copy
of a search warrant (including any appendices and the statement of probable cause)
authorizing the search of the digital storage media, or a copy of the probation/parole
search conditions that would allow for the search for evidence relating to investigation.
(c)A listing of the items to search for (e.g., photographs, financial records, e-mail,
documents and or keywords).
Copyright Lexipol, LLC 2025/02/06, All Rights Reserved.
Published with permission by Fremont Police DepartmentComputers and Digital Evidence - 2
Fremont Police Department
Computers and Digital Evidence
(d)An exact duplicate of the hard drive or disk will be made using a forensic computer
and a forensic software program by someone trained in the examination of computer
storage devices