Ethics of the scene

Claim: When investigators seize a phone, they should copy it and search only the copy, even though making a forensic image takes extra time before anyone can look at the data.\nEvidence: Simply turning on a seized phone and swiping through it changes the device. Opening a message marks it as read, and new activity can overwrite deleted files or update timestamps, so the original state of the data is lost the moment someone browses it directly.\nReasoning: For digital evidence to hold up, an investigator has to show the court that what was presented is exactly what was on the device when it was seized, with nothing altered. Creating a verified image first, then searching the copy, keeps the original untouched and documented. If instead someone browses the live phone and changes it, a defense can argue the files were modified or added after seizure, and the judge may throw the evidence out. Copying before searching protects the data so it can actually be used in court.