Skip to content
Skip to main content
First Response & Preservation Operational Explainer

What should I do with a memory card?

Preserve the card as a small, easily lost evidential item and record the device, adapter and container associated with it. Do not insert it into an ordinary reader to identify its contents.

Record more than the card itself

Photograph the card and its position before handling where practicable. Note its type, brand, stated capacity, serial or other markings, physical condition and any write-protection tab. Record who possessed or controlled it and whether it was found in a camera, phone, drone, adapter, case or other equipment.

That context can help explain the card's likely use, but it does not prove which device created particular files or who operated it. Keep an adapter identifiable as an associated component without treating it as part of the card's unique identity.

Insertion and removal can change evidence

A receiving device may create folders, update access metadata, repair the file system or begin an automatic import. Moving a write-protection tab is itself a change and does not guarantee that every reader will prevent writes.

If the card is already installed in a powered, damaged, encrypted or recording device, document the complete system and seek specialist advice before removal. Package a loose card so it cannot bend, collect static, escape or be inserted accidentally; do not write on it or attach adhesive labels.

Key takeaway

Preserve the memory card together with its host and adapter context, because both ordinary insertion and premature removal can alter the evidence that later examination must explain.

Reference: FRP-152First Response & Preservation