Policy Text
University of California, San Francisco
Police Department General Orders
9.2 Collection and Preservation of Evidence
9.2.12 Seizure of Computer Equipment (Revised: 11/10/10)
A. General
1. Computer equipment can be severely damaged or data lost due to improper
handling. Systems can be programmed to delete all data if certain start -up or shut -
down protocols are not followed, resulting in the unintentional destruction of
evidence by seizing of ficers. Because of this, it is critical to use every precaution
in handling computer equipment seizures and using available resources.
B. Seizure
1. In each criminal case, the role of the computer differs. It may be an
instrumentality of the offense, an electronic filing cabinet or both. In any case, its
importance can be critical and its admissibility must not be jeopardized by
improper handling.
2. Most searches of computer systems should be pursuant to a warrant, but
recognized exceptions t o the warrant requirement (i.e., plain view, exigent
circumstance, consent) apply to the search and seizure of computers and
peripheral equipment.
3. Once the computer’s role is understood and legal requirements are fulfilled:
a. Secure the scene.
(1) Emphasize that officer safety is paramount.
(2) Preserve area for potential fingerprints.
(3) Immediately restrict access to computer(s).
(4) If possible, isolate the computer(s) from phone lines because data
on the computer can be accessed remotely.
b. Secure the computer as evidence.
(1) If computer is “off,” do not turn “on.”
(2) If computer is “on” and is a stand -alone (non -networked)
computer, consult a computer specialist.
(3) If a specialist is not available, contact Investigations Section
person nel.
(4) For networked or business computers, consult a computer
specialist for further assistance.
(a) Do not pull the plug. Pulling the plug could severely
damage the system and disrupt legitimate business.