Yeh I know you have an easier time of it in the US. ACPO guidelines are awkwardly worded at best; CPS asks us to steer clear of live work. This is the crucial

Yeh I know you have an easier time of it in the US. ACPO guidelines are awkwardly worded at best; CPS asks us to steer clear of live work. This is the crucial line: In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, what person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions. LEO's hate the idea of what exceptional circumstances could mean. And for the most part none of the police seizing machines have the competence to explain what they did and the implications. Most of the hi-tech crime SOP for law enforcement here (which was co-written originally by my current boss) asks to avoid live acquisitions. I obviously cant be specific but very few cases involve live data (of this type) and those that do usually never make it to court or are dismissed fairly quickly. (the main problem are defence teams with no technical knowledge who hire "specialists"; they will nitpick at every process undertaken if they can't pick at the evidence. This happens a lot and live evidence would be a field day for them)