Standards and compliance

The Twelve Stages

1. 01Identification

   Recognising which devices, accounts and data sources might hold relevant evidence, including the ones that are easy to miss such as routers, wearables, cloud accounts and the DVR in the next room. The usual failure is tunnel vision on the obvious phone and laptop. A written list of potential sources, with what each might contain, is what the authority stage needs.

2. 02Authority and Scope

   Establishing the legal basis for every action: a warrant, a court order, a summons under section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023, a contract or the owner's documented consent, together with the limits that go with it. Examinations that exceed their authority produce evidence that may be excluded and examiners who may be liable. The record of authority, and of what it does not permit, must travel with the evidence.

3. 03Preservation

   Stopping change from the moment a source is identified: isolating phones from networks, deciding whether a running system is kept alive, preventing writes and placing legal holds on cloud and corporate data. Powering on a seized SSD to have a look, or letting a phone receive a remote wipe, destroys evidence before anyone has copied it. Preservation delivers an unchanged source to collection.

4. 04Collection

   Taking physical or logical possession of the source: seizing the device, photographing it in place, labelling it and starting the custody record with the authority that allowed it. Under the Sanhita the search and seizure may have to be video recorded. Missing labels and unsigned seizure lists are the common failure. Collection hands acquisition an identified exhibit with a custody record already open.

5. 05Acquisition

   Making the forensic copy: a bit-stream image through a write blocker or duplicator, a logical or file-system extraction from a phone, a memory capture or an export from a cloud provider, with hashes computed as the data is read and verified afterwards. Imaging without verification, or without recording the tool, version and times, leaves nothing to prove later. Acquisition delivers a verified copy and the original untouched.

6. 06Examination

   Processing the copy to find and extract the data that may matter: parsing file systems, recovering deleted material, decoding application databases, carving unallocated space and filtering with known-file hash sets. Working on the master copy instead of a verified working copy is the classic error. Examination delivers extracted artefacts with their locations and the method used.

7. 07Analysis

   Working out what the artefacts mean in the context of the questions asked: building timelines, correlating sources, testing alternative explanations and separating what the data shows from what the examiner infers. Overreach, stating as fact what is only consistent with the data, is what gets reports attacked. Analysis delivers findings with their basis and their limits.

8. 08Documentation

   The contemporaneous notes, logs, screenshots and tool outputs that record what was done, when, by whom and with what result, from the first phone call to the last export. Notes written up a week later from memory are not contemporaneous. Documentation is what makes the work repeatable and is the source for the report.

9. 09Reporting

   Writing the findings so that a reader with no technical background can follow what was examined, how, what was found and what it means, with the hashes, exhibit references and limitations in place. Reports that bury the answer in tool output, or omit what could not be determined, fail the reader. The report delivers a document that can be read without the examiner present.

10. 10Presentation

    Giving evidence: in court, before a tribunal, to a board or to a client, increasingly over video under section 530 of the Sanhita. The examiner must explain, not advocate, and must be able to reproduce any figure in the report from the documentation. Being unable to say how a hash was computed is the failure that undoes everything before it. Presentation delivers testimony that matches the record.

11. 11Retention

    Keeping the original evidence, images, working copies, notes and reports for as long as the matter and any appeal, the client's instructions, the laboratory's policy and the law require, under the same access control and custody as during the case. Data protection law now adds retention periods and erasure duties of its own. Retention delivers an intact record for as long as it is needed and a date on which it stops being needed.

12. 12Secure Disposal

    Destroying or sanitising every copy when retention ends, with a documented method appropriate to the media, a verification step and a certificate of sanitisation kept with the case file. Returning a client's drive with another client's image still on it, or discarding a working copy unwiped, is a breach waiting to be found. Disposal closes the loop and leaves a record that the data is gone.