Onondaga County

Digital Evidence

Brianna Hahn, Computer Specialist III

The Digital Evidence section examines submitted electronic media for the purposes of acquiring, preserving, retrieving, and presenting relevant data that has been processed electronically and stored on the item.

Submission Guidelines

Digital evidence should be submitted to the CFS at the request of a law enforcement agency or attorney’s office.

Items acceptable for submission include:

• Computer systems (e.g. desktop, laptop, all-in-one)
• Mobile Devices (e.g. tablets, smart phones, GPS devices)
• Digital cameras
• External Media (e.g. hard drives, memory cards, thumb/flash drives)
• CDs and DVDs

Proper Handling / Collection

Digital evidence is fragile and can be altered, damaged, or destroyed by improper handling, packaging, and transportation. For these reasons, special precautions should be taken to preserve this type of evidence.

Computer Systems:

• If the computer is OFF, leave it OFF. DO NOT power it on to begin searching through the computer.
• Place device in original packaging, if available. Similar packaging, such as boxes with foam padding or paper, to prevent shifting is recommended.
• Collect and document how cords and cables are attached, if necessary.
• Gather any external hard drives or other relevant items.
• Obtain passwords, if possible. Passwords may be written down and stored near computers, in original device packaging, or in accompanying manuals or software information.

Mobile Devices: In General

• Collect phone chargers.
• Do not scroll or browse through an evidentiary device, this may alter the integrity of the data.
• If any manipulations are made, document any actions that were done on the device.
• Place device in appropriate packaging.
• Obtain passwords, pin numbers, or screen pattern lock code, if possible. Passwords may be written down and stored in original device packaging or in accompanying manuals or software information.

For devices that are ON:

• DO NOT TURN IT OFF
• Establish network isolation. Methods for isolation include enabling “Airplane Mode” or placing device in radio frequency (RF) shielded packaging (“Faraday” bags, aluminum foil, arson cans).
• Verify Wi-Fi and Bluetooth are disabled.
• Keep the device powered, connect to a portable battery charger or USB power bank.
• Transport to the Center for Forensic Sciences as soon as possible.
• Notify the Evidence Intake Personnel at the time of submission that the item is on and whether it is an iOS device.

For devices that are OFF:

• Transport to the Center for Forensic Sciences as soon as possible.
• DO NOT power the device on.

Helpful Information

• Provide a copy of the legal authority or applicable justification (e.g. search warrant or consent form)
• Photograph of the suspect if identification in photos/videos is needed
• When seizing computer systems and/or mobile devices, look for “peripherals” such as, cables, chargers, flash or thumb drives, external hard drives, and SD/microSD cards.