|Volatility of digital evidence|
DOJ National Institute of Justice
Digital data are stored in various forms (random access memory (RAM), read-only memory (ROM), hard drives, and other magnetic or optical media) and are subject to inadvertent alteration, degradation or loss. Almost any activity performed on a device, whether inadvertant or intentional (e.g., powering up or shutting down) can alter or destroy potential evidence. In addition, loss of battery power in portable devices, changes in magnetic fields, exposure to light, extremes in temperature and even rough handling can cause loss of data. Due to these factors, steps should be taken in a timely manner to preserve data.
Special precautions should be taken when documenting, collection, preserving and examining digital evidence. Failure to do so may render it unusuable, result in an inaccurate conclusion or affect its admissibility or persuasiveness.
Activities that should be avoided include the following: