Can I open or access a storage device myself before handing it to a forensic expert?

No – you should absolutely not open, power on, or browse the storage device yourself before handing it over to a forensic expert.

Even seemingly harmless actions can:

• change critical timestamps (last accessed, modified, MFT change times)
• overwrite deleted files or unallocated space
• trigger anti-forensic mechanisms or encryption routines
• destroy or seriously weaken the evidentiary value of the data in court

Correct procedure

1. Leave the device exactly as it is (do not switch it on, do not connect it to a computer).
2. If it is running — do not switch it off either (pulling the plug is safer than a normal shutdown).
3. Hand the device over in its original state.
4. The forensic expert will create a verified bit-for-bit forensic image (with SHA-256/MD5 hashes) and perform all analysis on that copy only.

Following this simple rule very often decides whether the evidence will be accepted by the court or rejected as “contaminated”.