Digital Evidence First Responder Checklist

Scene and authority

• Identify the lawful basis for seizure, consent, search, preservation, or examination.
• Separate officer safety and scene safety decisions from forensic decisions.
• Document who found the device, where it was located, and who handled it.
• Do not exceed the scope of authority or agency policy to search content.

Document before handling

• Photograph the device in place when practical.
• Record make, model, serial number, visible account names, phone number, screen state, battery state, and connected accessories.
• Note whether the device is locked, unlocked, powered on, powered off, damaged, charging, or connected to a network.
• Document date, time, time zone, collector, and case identifier.

Preservation mindset

Digital evidence can be changed or destroyed through ordinary interaction, remote access, synchronization, power loss, or network connectivity. Preserve first, examine later, and involve trained personnel early.

• Avoid unnecessary tapping, scrolling, searching, or opening files.
• Do not guess passcodes or attempt biometric unlocks without policy and legal direction.
• Maintain chain of custody and evidence packaging according to agency procedure.
• Use an evidence lab, task force, or qualified examiner when the case exceeds local capacity.

Training need indicators

• Responders are unsure how to handle powered-on mobile devices.
• Agency policy does not address cloud accounts, synced devices, or messaging apps.
• Reports do not consistently document time zones, device state, or collection steps.
• Prosecutors regularly request additional documentation before charging decisions.