G14.1.5 Seizing Electronic Devices
Chapter: Chapter 14 – Collection and Preservation of Evidence
Sub-Chapter: 14.1 - Evidence Collection
Effective Date: 11/01/2019
Revised Date: 02/08/2023
Rescinds: G14.1.1 – 11/1/2019
Purpose
To define the procedures the Indiana University Police Department (IUPD) will follow when collecting, processing, and preserving computer equipment and other devices capable of storing electronic data as evidence.
General Order
The IUPD will follow the procedures outlined in this general order when collecting, processing, and preserving electronic devices as evidence. IUPD personnel will collect, process, and preserve electronic devices commensurate with the training they have received.
Procedures
Computer equipment and other electronic devices can be severely damaged or data lost due to improper shutdown procedures. Officers will be conscious of the potential for pre-programming to erase or destroy data that is tampered with in violation of the program’s security procedures. Officers will exercise extreme caution when seizing and/or examining electronic equipment so as not to cause severe damage or the loss of valuable data. When feasible, investigators trained in the specific handling of digital media, devices, and evidence should be consulted prior to moving, seizing, or powering down any electronic device above common hand-held devices such as cell phones or tablets.
To ensure that all digital devices which are seized for forensic examination are properly handled and preserved, the following procedures will be followed:
- The device will be photographed prior to being collected.
- The location where the device was found, any visible damage, and serial numbers or unique identifiers will be documented in the case report.
- If the device is submerged in water, it should be collected in that same water until transferred to a digital forensic examiner.
- Attempts may be made to obtain the passcode to the device from the device owner. Officers will document any passcode information received from the owner but will not enter the passcodes into the device.
- The device should remain in its current power state. If the device is powered off, leave it off. If the device is powered on, steps should be taken to ensure the device remains on until it is transferred for examination.
Computers
- Document any on-screen images before collecting the computer.
- Disconnect all network and power cables from the computer.
- If there are external storage devices attached, recover the cables connected to the storage device.
Mobile Devices
- If possible, put the device in airplane mode and turn off Wi-Fi and Bluetooth. Personnel will not manipulate the device in any other way unless advised to do so by a forensic examiner.
- The device will be stored in a faraday bag with a charging source and secured as soon as practicable.
The IUPD has a collaborative working relationship with digital forensic examiners who have completed specialized training in the examination of digital devices such as cell phones, computers, tablets, and removable storage devices to locate evidence of criminal activity. IUPD personnel may be assigned to local digital forensic units and will receive training and remain proficient in their duties within the unit.