Search, Seizure, Preservation and Chain of Custody

What it is

Before evidence can be used, it must be obtained lawfully and protected from the moment it is found. This page covers the legal authority to search (consent or a warrant), the first steps at the scene, how evidence is preserved and tracked, and how target media is prepared.

How it works

Seeking consent

Consent is permission to search given by a person with authority over the property. To be valid it must be voluntary, given by someone with authority over the system, and clear about the scope. Consent should be written, signed and dated, and it can be withdrawn. In a workplace, a policy and a login banner that tell users that systems are monitored help establish consent for a search of company equipment.

Obtaining witness signatures

A witness signature records who saw or did what. Investigators obtain signed statements from the people present at the scene, the person who gave consent, the system owner and any administrator who handed over access. Signatures also confirm the contents of an evidence receipt or seizure list. These records support authenticity and the chain of custody.

Obtaining a warrant for search and seizure

In the United States the Fourth Amendment protects against unreasonable searches. A search warrant is issued by a judge or magistrate based on probable cause, supported by a sworn statement (affidavit). It must describe with particularity the place to be searched and the things to be seized. For digital evidence the application should say what devices and data are sought, because a warrant limits the scope of the search. Evidence collected beyond the warrant, or without valid authority, can be excluded.

Searches without a warrant

Some situations allow a search without a warrant:

The exceptions are narrow. A court decision in the United States (Riley v. California) held that police generally need a warrant to search the data on a cell phone, even after an arrest. Private organizations searching their own systems act under policy and consent rather than the Fourth Amendment, but the rules differ by country.

Initial search of the scene

When the investigator arrives:

1. Confirm legal authority.
2. Secure and isolate the scene and keep unauthorized people away.
3. Do not allow anyone to touch, power on or off, or use the devices.
4. Photograph and sketch the scene, including screens, cables and connected devices.
5. Note the state of each device: on or off, programs open, network connections.
6. Identify all evidence sources, including phones, removable media, notes and passwords.
7. Interview witnesses and note their details.
8. Decide, per device, between live and dead acquisition.

Preserving evidence

• Use anti static bags for storage media and sealed, labeled evidence bags.
• Use a Faraday bag for phones to block network signals so remote wipe cannot be triggered.
• Keep items away from heat, moisture and magnets.
• Label each item with case number, description, date, time and collector.
• Make working copies and keep originals sealed.
• Record hash values of the source and every image.
• Store evidence in a controlled, access limited location.

Chain of custody

The chain of custody is the documented, unbroken record of who handled the evidence, when, where and why, from collection to court. A record typically lists:

A gap in the chain, such as an unrecorded handover, lets the other side argue the evidence was altered.

Sanitizing the target media

When making a copy, the destination media (the disk that will receive the image) must be forensically clean so old data cannot be mistaken for evidence or contaminate the case. Sanitizing means wiping the destination so that no old data remains, and then verifying the wipe. NIST SP 800-88 describes three levels: clear (overwrite using standard commands), purge (stronger methods that make recovery infeasible, such as cryptographic erase) and destroy (physical destruction). Only the destination is wiped. The evidence source is never wiped or changed.

A worked example

At a small office, an investigator finds a running laptop and a phone on a desk. The office manager gives written consent.

The investigator photographs the scene, places the phone in a Faraday bag, captures memory from the laptop, images the drive onto sanitized media, hashes both, labels the items and starts a chain of custody form, with the manager's signature on the seizure list.

How the exam asks about this

• "Which record documents every person who handled evidence?" → The chain of custody.
• "Why is a phone placed in a Faraday bag?" → To block signals so it cannot be remotely wiped or changed.
• "What must a warrant describe with particularity?" → The place to be searched and the items to be seized.