What should be recorded about removable storage?¶

Removable storage should be recorded in enough detail to identify the item, its condition and its relationship to the investigation.

Avoid this assumption: Writing “USB stick” or “memory card” is sufficient. Many devices look similar, and labels can be changed, duplicated or misleading.

Record the type of media, such as USB storage, memory card, external drive, optical disc or removable module.

Capture the make, model, colour, capacity, serial number, asset tag, labels, markings and physical dimensions where relevant.

Record switches, write-protection tabs, adapters, cables, cases, damage, contamination and whether the device appears opened or modified.

Photograph all sides and any packaging.

Record where it was found, its position, nearby devices, who had possession or control and whether it was connected.

If connected, capture the host device, port, cable, visible applications, file transfers, prompts and power state before any change.

Record whether the media is powered separately, encrypted, locked or showing activity lights.

Do not infer capacity, ownership or contents from appearance alone.

Maintain continuity by recording every person who handles, packages, transports or examines the item.

Use suitable packaging that prevents loss, static damage and accidental connection.

Keep associated adapters and cables identified, but package them in a way that avoids scratching or damaging the media.

Record whether the item has a protective cap, carrying case, docking station or proprietary connector, because these may help identify its normal use and associated equipment.

Operational takeaway¶

Record removable storage as a distinct evidential item with complete identifiers, condition, location, connected state and handling history before any examination.