Clearly, there will be cases where the most appropriate action is to seize all the physical hardware at a suspect s location. Perhaps it is the only option that the minimally trained responder has at their disposal. Maybe the forensic preview software didn t support the graphics card for the computer. It s possible that additional keyword searches need to be performed or items need to be carved from drive free space, and both would be better performed in a controlled laboratory environment. There are any number of reasons why the on-scene responder will choose to seize the physical container, and that s ok! The important point is that the most appropriate method of seizure is chosen to match the responder s skill level, and that it appropriately addresses the type of crime.

The minimization stage may provide the investigator with the places computers, storage media, and so on that have the highest probability of containing the desired information. A preview on-scene may verify that the information exists. In cases of child pornography possession, the on-scene preview may allow the investigator to take the suspect into custody right at that moment or at least have some very frank discussions about the material found on the computer. The case may be provided to a prosecutor with just the previewed images, and discussions of sentences and pleas can occur immediately, instead of having to wait for a complete forensics examination. If the case is referred to trial, the full forensic analysis of the...