Chapter 8 - Seizure of Digital Information

Abstract

This chapter discusses the seizure of digital evidence, focusing on physical hardware. The proliferation of personal computers has changed the way computers are involved in criminal issues. In the past, computers were used primarily as the attack platform or target of the attack. Now, the more personal use of computes creates a situation where the computer is the storehouse of evidence relating to almost every type of crime imaginable. The result is that more computers are involved in some manner in crime and that more computers need to be examined for information of evidentiary value. But before they can be examined, they must be seized. The on-scene responders/investigators often know very little about computers and often have not been instructed on how to properly seize digital information. Existing seizure protocols for physical items are used, resulting in a focus on the seizure of the computer hardware—sometimes the entire computer, including the monitor, printers, keyboard, and so on are seized and packaged for delivery to the lab. Over time, it became accepted to use the seizure methods focused on the seizure of the physical hardware for the seizure of digital information.