Seizing, preserving and documenting devices

At 5:40 p.m. on March 19, ninety minutes after Pike's arrest, Detective Park stood beside the grey car outside Harold Mercer's house with an exhibit officer, Constable Dana Whyte. The car had been towed to the police garage and Park had obtained a warrant to search it. In the glove compartment was a second phone, switched off, in a black case. In the centre console were two prepaid gift cards still in their packaging, a slip of paper with Mercer's address written in pencil, and a charging cable. The car's dashboard screen showed a navigation system. Whyte photographed each item where it lay, then seized the phone without turning it on, recorded its make, model, colour and case, and the identifying number printed on its SIM tray, packaged it, sealed and labelled the package, and wrote it into the exhibit log. Park photographed the navigation screen and asked the digital forensics unit whether the car's system could be examined.

This lesson covers the steps between finding a device and handing it to an examiner: deciding what to seize, recording it, packaging and labelling it, keeping it safe, and documenting every movement. These steps are not glamorous, but Desjardins tells the class that more digital evidence is lost through sloppy handling at this stage than through any clever defence argument at trial.

Deciding what to seize

Officers should seize what the legal authority permits and what the investigation needs. A warrant may authorize the seizure of specified devices or classes of devices, and officers must stay within it. Where the authority is consent, the person consenting must understand what they are agreeing to and that they can refuse or withdraw, and officers should take only what the consent covers. Where devices are seized on arrest, the device may be held, but searching its contents raises separate legal questions covered in lesson 10.

Within the authority, officers should think about every device that could hold relevant evidence, including the less obvious: a second phone, a tablet in a child's bedroom that the suspect also uses, a memory card in a camera, a USB stick on a keyring, a smart watch, a laptop's power supply, which may be needed to start it. They should also think about what not to seize. Taking every device from a business can shut it down, and taking a family's only phone can leave them unable to call for help. Sometimes a forensic copy can be made on site, or a device can be returned after imaging. Seizures must be proportionate, and officers must be able to explain them.

Recording the device

Before anything is moved, the device should be photographed in place, showing where it was found, what it was connected to, and the state of any screen. The officer should then record a full description: type, make, model, colour, case or cover, visible damage, serial numbers or other identifiers that can be read without powering it on or opening it, whether it was on or off, locked or unlocked, connected to power or a network, and what cables, chargers or accessories were with it. For phones, the number printed on the SIM tray or on a label under the battery cover can identify the device to the carrier. If a SIM card or memory card is visible, it should be recorded, but generally not removed at the scene unless the service's policy calls for it.

The officer should also record who appeared to use the device and any information given about passwords or patterns. Pike's first phone was in his hand. The second was in a glove compartment of a car registered to his mother, which he said he drove every day. Those facts would matter later in showing that he, not his mother, used the second phone.

Packaging and labelling

Devices should be packaged to protect them from damage, tampering and network connection. Phones that are on should go into signal-blocking containers with power, as lesson 7 described. Devices that are off can go into anti-static bags or rigid boxes. Packages should be sealed with evidence tape and the seal signed or initialled across, so that any opening is visible. Each package gets a label with the file number, exhibit number, description, where and when it was found, who found and seized it, the authority for the seizure, and who sealed it and when.

Officers should not attach labels or tape directly to devices in ways that cover screens, ports or identifiers, and should not write on devices. They should keep devices away from heat, moisture and strong magnets, and should not put several devices loose in one bag where they can damage each other. A device that is wet should not be turned on or dried with heat; it should be kept as it is and taken to the examiners quickly.

Continuity

Every movement of a digital exhibit must be documented, just as with physical exhibits. The evidence course described continuity for the glass shard in the Bayview break-in; digital exhibits need the same care, with added attention to whether anyone accessed the data. The record shows when the exhibit was received, from whom, what was done with it, where it was stored, and to whom it was passed. For digital exhibits, the record should also show whether the device was powered on, connected to anything, or examined, and by whom. A gap in the record, or an unexplained change to the device's data, can lead a court to give the evidence less weight or, in serious cases, to doubt it altogether.

# Checking a continuity log for gaps and out-of-order entries
from datetime import datetime
log = [
    ("2026-03-19 17:55", "sealed by Whyte at police garage"),
    ("2026-03-19 18:30", "lodged in exhibit locker 12 by Whyte"),
    ("2026-03-20 08:10", "signed out to digital forensics by exhibit clerk"),
    ("2026-03-20 08:25", "received by examiner Lam; seal intact"),
    ("2026-03-27 16:40", "returned to exhibit room by Lam; resealed"),
]
times = [datetime.fromisoformat(t) for t, _ in log]
ok = all(a < b for a, b in zip(times, times[1:]))
print("entries in time order:", ok)
for (t1, e1), (t2, e2) in zip(log, log[1:]):
    hours = (datetime.fromisoformat(t2) - datetime.fromisoformat(t1)).total_seconds() / 3600
    print(f"{hours:6.1f} h  {e1}  ->  {e2}")

entries in time order: True
   0.6 h  sealed by Whyte at police garage  ->  lodged in exhibit locker 12 by Whyte
  13.7 h  lodged in exhibit locker 12 by Whyte  ->  signed out to digital forensics by exhibit clerk
   0.2 h  signed out to digital forensics by exhibit clerk  ->  received by examiner Lam; seal intact
 176.2 h  received by examiner Lam; seal intact  ->  returned to exhibit room by Lam; resealed

The log for exhibit 7 is in time order, and each transfer is signed. The longest interval, seven days, is the period when the examiner had the phone, which her own notes cover hour by hour. Desjardins tells the class that the question a defence lawyer asks about digital exhibits is not only who had it, but who touched the data. The examiner's notes and the hash values described in the next lesson answer that.

Preserving what is not in hand

Much of the evidence in a cybercrime case is held by others, and preserving it is as urgent as seizing devices. Service providers keep records for limited periods and may delete accounts that are reported or abandoned. Police can ask providers to preserve data voluntarily, and the Criminal Code provides for preservation demands, which a peace officer can make without going to a judge when there are reasonable grounds to suspect an offence and the data will assist, and preservation orders made by a justice or judge. A preservation demand requires the provider to keep the data for a short period while police obtain a production order; it does not give police the data. Lesson 10 covers how the data is then obtained.

Evidence held by victims and witnesses also needs preserving. Store owners should be asked to save security video before it is overwritten. Victims should be asked not to delete messages, emails or accounts. Bank branches should be asked to keep video of transactions. Mercer's bank branch kept its video for 30 days, and Park's unit asked for the March 19 footage the next morning, which later showed Mercer's call with the 'grandson' continuing on his mobile phone while he stood at the teller's counter.

Passwords and locked devices

Many seized devices are locked, and modern phones are strongly encrypted. Examiners have tools that can sometimes extract data from locked devices, but not always. Officers sometimes ask suspects for their passcodes. A suspect may volunteer a passcode, and officers should record exactly what was said. Compelling a suspect to reveal a passcode raises serious legal questions. In Canada, the right to silence and the protection against self-incrimination limit what police can demand, and courts have been reluctant to order accused persons to unlock devices. First officers should not threaten, trick or pressure suspects into revealing codes, and should get legal advice before asking a suspect in custody, who has the right to counsel. Pike did not give his codes. The examiners were able to extract data from both phones under the warrant described in lesson 10.

Vehicles, smart devices and the cloud

Modern vehicles store large amounts of data: navigation destinations and routes, phones that have connected by Bluetooth, contact lists and messages synced from those phones, and sometimes speed and braking records. Extracting it requires specialized tools and often removing parts of the vehicle's systems, so the vehicle should be secured, its battery state noted, and the forensics unit consulted before anything is touched. Park's request about the grey car's navigation system led to an extraction that showed the car had been driven to each collection address on the dates in Pike's messages, which supported the evidence that he, not his mother, had been driving.

Smart home devices, such as doorbells, cameras, speakers and thermostats, usually keep little on the device itself and much more in the cloud account linked to them. Seizing the device may be less useful than preserving the account and obtaining its records with the owner's consent or legal process. The same is true for many phones: messages, photos and backups may be stored in the user's cloud account, and some may exist only there. Accessing cloud data through a seized device raises its own legal questions, because the data is stored elsewhere, and the warrant or order should address it expressly. First officers should note any cloud services that appear to be in use, and should not open them.

Returning devices

Devices seized from victims, witnesses and even suspects should be returned when they are no longer needed, unless they are themselves evidence that must be kept for trial, are subject to forfeiture, or contain illegal material. Keeping a person's phone for months can cost them their job, their schooling or their contact with family. Many services now image devices quickly and return them, keeping the verified copy as the evidence. The decision to return, and its timing, should be recorded, along with any disclosure obligations about what was copied.