25.00.060     COMPUTER EQUIPMENT SEIZURE                 (CALEA 83.2.5)

 

When officers suspect that a computer must be seized as evidence, they should contact the Department’s computer crimes investigator or Washington State Patrol Crime Laboratory personnel for advice and assistance.

 

Any investigator handling computer and computer related equipment as part of a criminal investigation should wear latex rubber gloves at all times.  Fingerprint powder should not be applied to the equipment.  These precautions will minimize the risk of damage to the computer components and electronic media containing potential evidence.

 

The computer system should be photographed and documented as it was found.  In all instances, stand alone or networked, a Department computer crime investigator or the WSP Crime Lab should be contacted and asked for assistance.

 

General Guidelines

 

v     If the computer is off, leave it off.

 

v     If the power to the computer is on, photograph the screen and write down the name of the files and applications running.  Do not turn off the system.

 

v     For stand alone systems attached to a power source but not running, disconnect all power sources, and unplug from the wall and the back of the computer.

 

v     For networked systems, the process is more complicated and technical.  Do not touch the computer.  Photograph the screen and document any programs running.  Consult with a computer crimes investigator.

 

v     Photograph the back of the computer to record the cable connections.

 

v     Label all cables indicating which cable is connected to which port on each device.

 

v     Photograph and document all attached devices (i.e., printers, etc.).

 

v     Disconnect all cables and attached devices.

 

v     Secure the computer against tampering.

 

v      Place a piece of evidence tape over the entrance to the disk drives and on the computer case in such a way that if someone were to use the drive, the changed tape will show tampering.

 

v     Initial and date the edge of the tape.

 

Subject to legal requirements, search warrants, or probable cause seize other items that can store information such as floppy disks, CD’s, computer tapes, cartridges (i.e., “Zip” or “Jazz” disks), and memory cards.  Also consider data bank watches, pocket organizers (i.e., “Palm” devices), pagers, and electronic Rolodex.

 

Seize other devices attached to the computer, such as monitor, keyboard, mouse, printer, external drivers (CD/DVD/Tape), camera, modem, etc.

 

Seize any manuals for operating systems and programs.

 

All computer equipment should be packaged following these guidelines:

 

v     Use original boxes and foam inserts, if available

 

v     Boxes are preferable for packing, if available

 

v     Use bubble wrap or solid foam packing, if available

 

v     Do not use Styrofoam peanuts or shredded paper; these will cause static electricity and dust

 

v     Place other storage media in boxes or paper bags.  Do not use plastic bags; they can generate static electricity

 

v     Mark each item on the item itself, for identification

 

v     Seal each package, initial, and date

 

Transporting computer/media evidence should be accomplished by the following standards:

 

v     Transport the evidence inside the passenger area of the vehicle

 

v     Do not place computer/media evidence in the trunk of the vehicle next to the radio transmitter.  Transmitters emit RF and electromagnetic energy that can damage disks and hard drives.  Consider turning off the vehicle radio during transport

 

v     Avoid exposure to extreme heat and cold