Which ACPO principle states that no action should change data held on a computer or storage media which may subsequently be relied upon in court?

• A. ACPO Principle 2
• B. ACPO Principle 1
• C. ACPO Principle 3
• D. ACPO Principle 4

Answer: (B)

Preserving the integrity of digital evidence is the focus: the idea is to avoid any action that could modify data that might later be used in court. This principle is the best fit because it explicitly states that no action should change data held on a computer or storage media that may be relied upon in court. By upholding this, investigators protect the evidentiary value of the data, ensuring it remains as it was at the moment of collection. In practice, that means using write blockers when imaging devices, creating exact copies, calculating and preserving hash values to prove data hasn’t changed, and documenting every step to provide a clear, defensible chain of custody. The other principles address related concerns—how actions should be documented when preservation is necessary, who is authorized to handle data, and how custody is tracked—but they do not express the core prohibition on altering data itself.