Seizing Computers and Phones as Evidence at a Scene

Why seizure decisions matter for admissibility

The admissibility of digital evidence turns on two foundations: first, that the item in court is authentically the same device seized at the scene (a question of authentication under Federal Rule of Evidence 901); and second, that no gap or undocumented action casts doubt on whether the evidence has been altered or contaminated. Neither question is decided by following a procedure perfectly—a judge will ask, under FRE 901(a), whether there is evidence "sufficient to support a finding that the item is what the proponent claims it is." But a prosecution or party that cannot document what was done with the device at the moment of seizure, or cannot show that it was isolated from sources of change, faces a challenge the evidence may not survive. The first hour at the scene is not routine. It is the foundation.

Documenting the device's state before it moves

Documentation of a device's state must occur before it is packaged and moved, because that record is the only evidence of its condition at the moment of seizure. [4] Recommends that a record of all visible data be created. [5] Recommends that all digital devices, including mobile phones that may store data, should be photographed along with all peripherals, cables, cradles, power connectors, removable media, and connections, and that touching or contaminating the device when photographing it should be avoided.

If the device's display is in a viewable state, the screen's contents should be photographed and, if necessary, recorded. [5] For powered-on devices, the time, service status, battery level, and other displayed icons should be captured. [4] Recommends that documentation may include a written description or photographs of the collection location, the device state (powered on or off, locked or unlocked), any known pin code or password, the time displayed on the device, network connections, external physical characteristics, and examiner interactions with the device.

This documentation serves two purposes: it creates a record that will satisfy FRE 901(b)(1) (testimony about an item's condition) and FRE 901(b)(4) (distinctive characteristics), and it preserves evidence of the device's operating state—power level, connections, notifications—which may be relevant to determining what data exists and why.

Power status: preserving evidence without destroying it

Whether to power off a device at the scene depends on the type of device and the risk of data loss. The question is stated as a premise: when you seize digital evidence, actions taken should not change that evidence. [2] Acknowledges that documenting the power status of the device (on, off, or in sleep mode) is a required preservation step.

For mobile phones, the risk profile is acute. Phones can receive network traffic—SMS messages, push notifications, cloud synchronization—that overwrites or adds to existing data even while in your custody. [1] Advises that switching a phone off is advisable because of the potential for loss of data through network activity and synchronization. The safer course is to power off a phone to stop background processes, though this must be documented as part of the seizure record.

For computers, the decision is more nuanced. A computer running may be in sleep mode, hibernation, or active use. Powering it off may flush volatile data from RAM—data not yet written to disk that may be relevant to the investigation. But leaving it on and connected to power or network may cause it to sync with cloud services, check for updates, or write new data to disk. The governing principle is the same: document the state you find, then isolate the device to prevent further change. If the computer is on, photograph the screen and network connections; photograph the power cable and outlet; then unplug the power without forcing a shutdown, and remove or disable any network adapters. Plug it back in only in a forensic environment where changes can be monitored and documented.

Isolating mobile devices from networks at the scene

Isolating a mobile device from all radio networks—WiFi, cellular, and Bluetooth—is essential to prevent new traffic from overwriting existing data and to avoid the question of whether data received after seizure falls within the scope of authorized evidence collection. [1], [2]

The practical methods are straightforward: turn off WiFi and Bluetooth through the device's settings if possible without unlocking it; remove the SIM card to disable cellular service; or place the device in an off state. If the device's screen is locked and you cannot access the settings, powering it off is the direct approach. Some jurisdictions may use a Faraday bag—a container lined with conductive material that blocks radio signals—to isolate the device during transport. None of these methods requires handling the device in a way that alters its visible condition or forces access to its contents.

If the device is found connected to another device or power source—plugged into a computer, in a cradle, charging—unplug it immediately from the back of the computer or power adapter to stop data transfer or synchronization. Do not pull the cable from the device itself, as this may cause physical damage that could be challenged in court as device tampering.

What not to do at the scene

Two rules have no exception: media cards, SIM cards, and other hardware residing in the phone should not be removed at the scene. [5] Removal may cause damage, may alter the device's evidence value, and may separate evidence from the device with which it is associated. Removal belongs in a forensic laboratory under controlled conditions.

Second, suspects or persons of interest should never be allowed to handle mobile phones or other mobile devices found at a scene. [5] Allowing a suspect to touch, unlock, or use the device introduces multiple evidentiary problems: you cannot show who changed what on the device; the suspect may have deliberate or accidental access to the device's unlock methods; and the suspect may be able to argue they were assisting in the examination rather than that the device was seized from them. Maintain exclusive custody from the moment you arrive.

Sealing and initiating the chain of custody

Once the device is documented and isolated, it should be sealed in a static-proof bag—a bag treated with an anti-static coating to protect the device from electrostatic discharge that could cause damage or data loss. [4], [5] The bag should be labeled with a tag that includes the case number, item description, date, time, location, and collecting officer's name. The individual who seizes the device must sign and date the tag to initiate the chain of custody. This happens at the scene, not later at the office or laboratory. [4]

The chain of custody documentation should be contemporaneous with the collection and should include a description or unique identifier for the evidence (such as serial number), the date and time of receipt, and a record of all transfers. [4] The first entry on that form is the seizure itself—who took the device, from where, at what time, and in what condition (powered on or off, locked or unlocked, sealed in what container). From that point forward, every person who handles the device must be recorded, with the date, time, and purpose of handling.

This documentation is not merely administrative. It is the evidence that establishes the device's chain of custody and, combined with the photographs and condition notes, satisfies FRE 901(b)(1) (testimony by the seizing officer about the item's identity and condition). If the device later goes to a forensic lab, that lab's initial receipt entry will link back to the scene seizure, creating an unbroken record.

Packaging for transport and storage

After sealing in a static-proof bag and tagging, the device is ready for transport to the forensic laboratory. The bag itself serves as the evidence container and as a tamper-evident seal. If the bag is opened before the laboratory receives it, that opening is visible. The outer packaging should protect the device from physical damage—a padded envelope, box, or rigid container. Mark the outer packaging with "FRAGILE" and "DO NOT OPEN" if appropriate to the jurisdiction's practice.

The device should not be placed in a locked safe or evidence locker at the scene if that locker will not be opened until the device reaches the lab. The goal is to maintain documented access: who touched the device, when, and for how long. Every gap in the record invites challenge. If the device sits in an evidence room for six hours with no entry, and the next person in the chain did not verify the seal, the defendant's expert will ask at trial how you know the device was not opened and altered during that six-hour gap.

Authentication and admissibility at trial

The seizure and custody work you do at the scene provides the foundation for authenticating the device in court. Under FRE 901(b)(9), evidence describing a process or system—in this case, the seizure process and the chain of custody—and "showing that it produces an accurate result" satisfies authentication. Your testimony that you seized the device, documented its state, sealed it, and maintained a continuous record of who had it shows that the device in the courtroom is the same device from the scene.

If the device is later cloned or forensically imaged in the laboratory, and that image is presented as evidence, the image itself must be authenticated. FRE 902(14) permits data copied from an electronic device to be admitted as "self-authenticating" if authenticated by a process of "digital identification"—commonly, a hash value (a cryptographic number that confirms the copy is byte-for-byte identical to the original)—shown by a certification of a qualified person with proper pretrial notice. But that authentication depends on the foundation: the image is identical to what? To the device seized at the scene. That foundation is built by what you do at the scene: documenting the device, isolating it, and maintaining the chain of custody.

Maintaining the integrity record

The rule that guides all of this is simple and unforgiving: once an item of evidence leaves your sight, you must be able to show that it could not have been altered. That is not because anyone expects it was altered; it is because the rules of evidence require proof that it was not. Everything you document at the scene—the photographs, the condition notes, the tag on the bag, the signatures on the chain of custody form—is evidence of that. If you omit any step, you will be cross-examined about it. If you can describe why the step was unnecessary in your case, you may satisfy that cross-examination. If you cannot, the evidence becomes harder to defend. At the scene, the cost of care is measured in minutes. At trial, the cost of carelessness is measured in cases lost.