Don't operate a suspect computer until a complete backup has been made of all storage devices. Standard computer backups won't do and a full bit stream backup is necessary. In the bizarre world of computer evidence, you always must assume that things will go wrong. Once computer evidence has been destroyed or altered, it is unlikely that it can ever be reconstructed. Murphy will be looking over your shoulder every step of the way and what can go wrong surely will go wrong.
Complete backups eliminate most of the potential problems.
Law enforcement officials normally seize computers during the execution of a search warrant. Depending on the circumstances and scope of the search warrant involved, all computer hardware, software and manuals should be taken for evaluation as potential evidence. Some prosecutors may view this as overly broad. Because computer technology changes so quickly, it may be impossible to obtain similar or outdated hardware or instruction manuals from other sources. Printers, tape drives, optical drives, hardware manuals and software manuals, should not be left behind.