With any case either on civil or criminal side it is important to get that data quickly and preserve it.  Digital evidence is fragile and continued operation or usage of that device could cause loss of evidence.  Even if it is not analyzed or review, the goal is preservation.  Let the legal system deal with accessing it after its preserved.

Take actions to immediately prevent this loss.  This applies to phones, computers, and vehicles

  • Stop using it.
  • Remove SIM card.
  • Turn off any screen locks or security measures.
  • Prevent any outside connections ( airplane mode)
  • Attempt to keep it in the state in which it exist but make sure to disconnect it from connecting to any network.

For 3rd party providers like Cloud storage, cellular phone carriers, Security CCTV providers or other such entities.

  • Send a preservation letter specify account information, date range of preservation, and legal standing for preservation.
  • With Security providers like Ring, Simply safe or any others like this.  There are very small windows of opportunity to get the data.  And that can be even smaller if the client has not paid up for extended services on their account.

You will have limited time to then acquire and legal authorization to then get that data from those provides.  Do not hesitate to get data preserved or captured even if the review or analysis of it needs to be agreed upon later.