Best Practices for Acquiring Digital Data from Passenger Vehicles
J3239
The acquisition of digital evidence from automobiles has become commonplace, with the number of data sources within vehicles continually growing. To that end, the potential for evidence spoliation is real in that the acquisition of data from one source could interfere with the data stored in another source. The purpose of this recommended practice is to provide information to assist in eliminating or at least minimizing the potential for evidence spoliation and also providing guidance as to when decisions must be made to prioritize the order of data collection.
Rationale: As the number of electronic data sources within vehicles increases, the potential for conflicts and data overwriting during the acquisition of this data also increases. Providing investigators with a platform for prioritizing the order of data acquisitions based upon the available data and the investigative needs will help minimize the loss of potentially valuable data.
