Because of the complex issues associated with digital evidence examination, please be recognized that this recommendations may not be feasible in all circumstances. The following guide’s recommendations are not legal mandates or policy directives, nor do they represent the only correct courses of action. Rather, these recommendations represent a consensus of the diverse views and experiences of the technical working group members who have provided valuable insight into these important issues. This guide is intended for use by law enforcement officers and other members of the law enforcement community who are responsible for the examination of digital evidence. This guide is not all-inclusive. Rather, it deals with common situations encountered during the examination of digital evidence. It is not a mandate for the law enforcement community; it is a guide agencies can use to help them develop their own policies and procedures.
Evidence Assessment: The digital evidence should be thoroughly assessed with respect to the scope of the case to determine the course of action. Conduct a thorough assessment by reviewing the search warrant or other legal authorization, case detail, nature of hardware and software, potential evidence sought, and the circumstances surrounding the acquisition of the evidence to be examined.
• Review the case investigator’s request for service.
• Consult with the case investigator about the case and let him or her know what the forensic examination may…