Updated 2026 UK guidance: How to collect, preserve and document e‑cigarette devices as forensic evidence

Introduction

The growing use and modification of e‑cigarettes has created new challenges for forensic practitioners, first responders and investigators. In February 2026 the Faculty of Forensic & Legal Medicine (FFLM) issued updated recommendations for handling vape devices and related biological material. This article explains the key principles from that guidance and from digital‑forensics best practice (including Cellebrite recommendations), and sets out practical steps to collect, preserve and document e‑cigarette devices as admissible evidence.

Key concepts at a glance

• Containment: use sealed, tamper‑evident bags for evidence to protect integrity.
• Storage conditions: freeze specified biological samples; store non‑biological items (devices, pods, cartridges) in a dry store at room temperature.
• Digital isolation: isolate devices from networks (Faraday bags, airplane mode or disable communications), document power state and remove batteries where possible.
• Forensic duplication: create a working copy using write‑blocking tools so the original is not altered; maintain an auditable chain‑of‑custody.
• Chemical analysis: recent reports (2024–2026) show e‑cigarettes can be modified to contain ethanol or other substances, so toxicology and chemical analysis of liquids and residues is important.

Detailed guidance for on‑scene collection

1. Scene safety and PPE

Always treat the scene with standard forensic precautions: wear appropriate personal protective equipment (PPE) — gloves, eye protection and, where aerosols or unknown liquids are present, respiratory protection. PPE protects both evidence and staff.

2. Photograph and document in situ

Photograph each device where it lies before touching it, recording multiple angles and a scale reference. Make clear scene notes detailing location, condition, visible damage, and proximity to other items (e.g. cigarette butts, liquids, packaging). The same basic techniques used for cigarette‑butt recovery apply to vapes: photograph in situ, note environmental conditions and bag items separately to avoid cross‑contamination.

3. Handling wet or contaminated items

If a device, cartridge or detachable component is wet, do not package it in sealed plastic while wet. Air‑dry the item in a secure, contamination‑controlled area (using PPE) and evidence trays if necessary, then seal. Wet biological samples intended for toxicology may require rapid freezing — see storage section below.

4. Packaging and labelling

Use sealed, tamper‑evident evidence bags for physical items and ensure every bag is labelled with date, time, location and collector’s initials. Evidence tape should be placed across the seal and initialled and dated by the person sealing it to preserve chain‑integrity.

Isolation and digital considerations (first responder priority)

E‑cigarette devices increasingly include wireless components and firmware that can be updated remotely. First responders should:

• Isolate the device from networks immediately — place it inside a Faraday bag where available, or enable airplane mode / disable communications if supported and safe to do so.
• Document and photograph the device’s power state (on/off) and any visible screens or LEDs.
• Where it is safe and technically possible, remove the battery to prevent remote wiping, auto‑updates or unintended activation. Record who removed the battery and when.

These steps help prevent loss or alteration of digital evidence before specialist examiners can create forensic images.

Digital forensics: creating a working copy and preserving originals

Best practice from digital forensics vendors and guidance (including Cellebrite) requires that examiners do not work directly on the original device. Instead:

• Use write‑blocking tools to create a forensically sound working copy (image) of the device’s storage.
• Document the imaging process thoroughly, recording tools, software versions, hashes and timestamps so the copy is auditable and verifiable.
• Retain the original device in tamper‑evident packaging in a secure store while analysis proceeds on the working copy.

Maintaining an auditable chain‑of‑custody at every step is essential for admissibility. This includes clear handover logs, signatures and time‑stamped entries whenever evidence changes hands.

Chemical and toxicology analysis

Recent forensic research and investigative reports (2024–2026) highlight that e‑cigarettes may be modified to contain ethanol, solvents or other substances. Where the device contains retained liquids, residue or suspect fillings, investigators should:

• Collect liquids and detachable cartridges separately, using clean, sealed containers suitable for chemical analysis.
• Send samples to a qualified laboratory for targeted toxicology and chemical profiling, noting that both device material and liquid can carry evidential traces.
• Retain chain‑of‑custody documentation for all samples submitted to laboratories.

Chemical analysis can link a device to an incident, identify illicit modification and provide evidential support in prosecutions.

Storage, retention and lawful disposal — regulatory context

From 12 August 2025 e‑cigarette products fall under WEEE Category 15 in the UK. This places obligations on producers and retailers for take‑back and record‑keeping. For forensic teams this has implications:

• Evidence stores should account for lawful retention periods and planned disposal routes; disposal of recovered devices must follow legal and environmental rules for electronic waste.
• When transferring devices to third parties (e.g. laboratories or retailers for disposal), record the legal basis and chain‑of‑custody details so regulatory obligations are met.

Investigative teams should liaise with their legal advisers and local waste‑management leads to ensure compliant, documented disposal at the conclusion of criminal proceedings.

Training, documentation and quality assurance

FFLM emphasises the need for staff trained in both physical and digital evidence procedures. Practical measures include:

• Regular training updates for first responders on device isolation and evidence packaging;
• Standard operating procedures that combine scene, scientific and digital‑forensics steps;
• Quality‑assurance checks on documentation, photographic records and chain‑of‑custody logs.

Good training reduces the risk of lost or excluded evidence and helps ensure findings are robust in court.

Practical example and product note

As an example of what investigators may encounter, disposable and cartridge systems are common at scenes. Investigators may recover disposable kits or refillable cartridges such as the 0mg ifresh 10000 Puffs 2in1 Disposable Pod Kit or loose replacement cartridges like 0mg eZee e‑cigarette cartridges (tobacco, 1050 puffs). Handling these items with the procedures above — isolation, photography, appropriate sampling for chemical analysis, and secure packaging — will preserve their evidential value.

Conclusion

The 2026 FFLM recommendations, together with established digital‑forensics best practice, give a clear framework for collecting, preserving and documenting e‑cigarette devices as evidence. Key priorities are isolation from networks, careful scene documentation, appropriate packaging (tamper‑evident bags), forensic imaging using write‑blocking tools, and chemical analysis where modification is suspected. Training, meticulous record‑keeping and awareness of WEEE (Category 15) obligations will ensure evidence remains admissible and is handled lawfully from scene to court.

For investigators and first responders, adopting these measures now will protect both the integrity of forensic examinations and the chain‑of‑custody required for successful prosecutions.