This question was prompted by a news article I read earlier today, in which a person described the dilemma they faced on discovering illegal material had been stored by an unidentified third party on their computer system:
He called the police, who told him to print it out and bring it to them. However it is illegal to possess images of child abuse, digitally or in print.
The crime is based on knowing possession, so once a person knows their computer contains such content, and decides not to delete it (or not delete it yet), they probably fall within the law.
So this made me think. If someone does find illegal material, what can they do?
Even to keep it long enough for police to be notified and attend would still be keeping/possessing it.
Knowing it's been stored in various backups might mean having to destroy important backups, as some of the most widely used backup and snapshotting systems don't have selective delete capability, you can only keep or delete the entire backup. (ZFS especially, widely used in many file servers for its utter reliability, is designed this way to preserve snapshot integrity: you can delete snapshots but not specific files in them).
Copying to a device such as a USB stick, even by or with police, may be a concern since in law, this creates a copy on the PC in order to copy it from server to USB stick.
I'm in the UK but interested in other jurisdictions as well. Clearly if you do something like any of these under direction of the police, who you promptly notified, it's not likely you'll be prosecuted, but it would make me (and perhaps many people) very uneasy even so, because it is against the law and there isn't any legal exception created for good cause or "because police told me to".
Also I can imagine in a worst case scenario, a bad file could have been there for months before coming to light, so copies may exist on effectively all data backups that exist - every company backup, and all of them immutable and critical.
So... What exactly is the position, and the appropriate action, and what is the position with critical backups that can't be modified by their nature?