What should I do with an external hard drive?¶

An external hard drive may contain substantial evidence and may also depend on power, encryption, software or an active connection.

Avoid this assumption: It can be unplugged and examined like a large USB stick. It may be transferring data, hosting a live database, supporting backups or mounted as part of another system.

Record the drive as found, including its position, power state, activity lights, cables, adapters, connected computer, port and nearby equipment.

Capture the make, model, serial number, capacity, labels, asset tags and physical condition.

Do not disconnect power or data cables automatically.

If the drive is active, record any visible file transfer, backup process, application, warning or mounted-drive name on the host system.

Removing it during writing may corrupt data, terminate a process or alter both systems.

Do not connect an unpowered drive to another computer merely to identify it.

Where the drive is already disconnected, preserve it in suitable protective packaging and keep associated power supplies and unusual cables identified.

Some drives use hardware encryption, proprietary enclosures, RAID arrangements or built-in network functions. Do not dismantle the enclosure or swap components.

Where encryption, active transfer, damage or unusual configuration is suspected, seek specialist support.

Record every disconnection, packaging and transfer decision.

Do not assume the external drive belongs to or was used by the person nearest to it.

Operational takeaway¶

Preserve an external drive’s power, connection and host-system context before removal, and use specialist support where activity, encryption or unusual hardware may affect the evidence.