When it comes to computer evidence, paranoia is a good personality trait to have. Do not operate a suspect computer until a complete backup has been made of all storage devices. In the bizarre world of computer evidence, you must always assume that there will be problems. Once computer evidence has been destroyed or altered it is unlikely that it can ever be reconstructed. Murphy will be looking over your shoulder every step of the way and what can go wrong surely will go wrong.
Complete backups eliminate most of the potential problems.
Seizure of All Relevant Materials Law enforcement officials normally seize computers during the execution of a search warrant. Depending on the circumstances and scope of the search warrant involved, all computer hardware, software and manuals should be taken for evaluation as potential evidence. Some prosecutors may view this as overly broad. Because computer technology changes so quickly, it may be impossible to obtain similar or outdated hardware or instruction manuals from other sources. Printers, tape drives, optical drives, hardware manuals and software manuals should not be left behind.