Law enforcement personnel must properly preserve digital evidence to make it suitable for presentation in court. Techniques may vary depending upon the technology, but officers have several considerations. They must have a secure storage location; sufficient back-up copies, as lost evidence can place prosecutions in jeopardy; and proof that the data has not been altered—that it is authentic.² Officers must ensure the long-term integrity of evidence. Further, investigators need to recognize that the chain of custody is just as important with digital evidence as it is with physical types, and they should have a written log to document any occasions in which the media goes in or out of storage or changes hands. As one fairly simple means of preservation, personnel can transfer digital information onto a read-only, nonrewritable CD-ROM. Investigators should make two copies and ensure that they put on each disk the operator’s name and signature, as well as the date and case number, and then treat each CD-ROM as they would any other item of evidence, establishing a chain of custody and securely storing the media.³

Concerning detectors or sensors with a removable media card, at the scene of the investigation, officers can seal the card in an envelope with the operator’s name and signature, the date, and the case number written on the outside. A secondary process involves uploading the data onto a secure server while employing a method, such as the hashing function, to ensure the data’s integrity. Investigators then can store the card in a secure location.⁴

Personnel using electronic equipment must ensure the accuracy of the date and time displayed on the unit. In many instruments, the date and time will default to an earlier period if the batteries become depleted. Then, restoration of power can result in readings that appear out of sequence. Some detectors will not afford the operator the ability to reset the date and time without a computer interface cable. An improper reading from one instrument could result in members of the jury questioning the readings from others, and they may perceive incompetence or a lack of care on the part of the operator.

Due to the inherent time lag between arrest and prosecution, officers should recognize that data files stored for a particular item of equipment may need proprietary software to retrieve and read the display. Prior to a courtroom prosecution, the detector or sensor used to gather the evidence could be replaced with a more current model or one from a different manufacturer. Personnel must retain copies of the proper software unless they have saved the data files in a universal format or exported the results in hard copy format and maintained those results as evidence. If they do not maintain the proprietary software, investigators may not be able to open the archived data files. As a general rule, personnel should store digital evidence in its original, as well as nonproprietary, format to ensure accessibility.⁵

Most law enforcement officers know that they should use a clean sheet of paper, new notebook, or fresh roll of film to document each crime scene to prevent details from other cases commingling with the one at hand. This rule also applies to digital evidence, such as that produced by a sensor. Despite the reusability of some units of storage media, merely erasing them is insufficient; they must be forensically prepared, or wiped. Investigators must not only remove any vestige of the previous contents but also ensure that only known data is written to each sector of the media. Personnel usually accomplish this with software that will overwrite a known character, such as 0 or 1, to the entire device and eliminate all of the previous data.⁶ Agencies should be prepared with a mitigation strategy for detectors and sensors that store data internally if they intend to use the readings as digital evidence. If available, a similar device employing removable storage media may be easier to sterilize and would allow the original removable storage media to be archived, if necessary, without the loss of the entire instrument. Alternatively, a digital photograph could be taken of the relevant readings from the device’s screen to document the events, and those digital photographs could be preserved.

Operators also should be aware that the names of the computer files exported by sensors often contain potentially important metadata, such as the sensor’s unique identification number and the date and time of the file creation. Accordingly, personnel should not change file names in any way. Further, if a reading is taken and an error is made, the created data file should not be deleted. Rather, this error should be documented and later explained during the operator’s testimony. Deleting files may create a gap in the sequential numbering system and could lead to the appearance that someone intentionally discarded the evidence.

The next step in the thwarted attack might be the use of an RIID to identify the type of radioactive material and its potential for harm. Certain radioactive isotopes work better than others in creating effective dispersal devices. Accordingly, the accurate identification of the isotope is critical in determining the danger posed. In this regard, RIIDs capture data and provide a preliminary assessment.

For a higher degree of assessment, during a process known as “reach back,” officers can use this type of device to electronically transmit data within an e-mail to a spectroscopist who can “read” the digital signature created by the energy generated from the material and then analyze this data and verify the internal assessment from the RIID. This process creates a tremendous amount of potential digital evidence that personnel might overlook or delete unless they recognize it in advance.

The data file from the RIID, the e-mail message used to transmit it, and any photographs sent all represent potential sources of digital evidence. Some agencies use an electronic template form to provide the incident background information during the reach back process, thereby creating more potential evidence.

Due to the critical nature of an incident, many departments use special operations commands to operate the identification devices. Because these personnel primarily focus on assessing a situation to resolve it without causing harm, agencies need to ensure they are trained to recognize that their assessment process is creating important digital evidence.

Calibrating and Testing Equipment

Creating usable electronic evidence also requires agencies to properly maintain and calibrate the instruments generating it, much like they service their speed-detection and alcohol-testing instruments. Of course, personnel need proper training to do this.

Departments also must retain records of calibration and repair for potential presentation to the court. While this process may seem complicated, agencies now consider it a matter of routine.

Additionally, officers who use these sensors and detectors must have knowledge of any set-up testing required before use. Personnel who have used radar guns for speed enforcement are well familiar with tuning-fork and internal-calibration checks that they must complete and document before deploying the device to issue tickets.

Similarly, many of the sensors and detectors used by hazardous materials teams and bomb squads require investigators to perform testing procedures before use. Agencies need to ensure that personnel not only perform the tests but record the results in the same way they do with enforcement equipment, recognizing the potential for usage data, such as material detection, to become crucial evidence needed in court. Departments should retain any documentation from the manufacturer, such as operator manuals, as controlled documents. Personnel also should test all equipment before use to ensure correct operation.