17.4. Pending such formulation, it would be required that the following minimum guidelines are implemented:
17.5. In the case of a personal computer or a laptop:
17.5.1. When carrying out a search of the premises, as regards any electronic equipment, Smartphone or e-mail account, the search team to be accompanied by a qualified Forensic Examiner.
17.5.2. When carrying out a search of the premises, the investigating officer should not use the computer or attempt to search a computer for evidence. The usage of the computer and/or search should be conducted by a properly authorized and qualified person, like a properly qualified forensic examiner.
17.5.3. At the time of search, the place where the computer is stored or kept is to be photographed in such a manner that all the connections of wires including power, network, etc., are captured in such photograph/s.
17.5.4. The front and back of the computer and/or the laptop while connected to all the peripherals to be taken.
17.5.5. A diagram should be prepared showing the manner in which the computer and/or the laptop is connected.
17.5.6. If the computer or laptop is in the power-off mode, the same should not be powered on.
17.5.7. If the computer is powered on and the screen is blank, the mouse could be WP No.11759/2020 moved and as and when the image appears on the screen, the photograph of the screen to be taken.
17.5.8. If the computer is powered on, the investigating officer should not power off the computer. As far as possible, the investigating officer to secure the services of a computer forensic examiner to download the data available in the volatile memory i.e., RAM since the said data would be lost on the powering down of the computer or laptop.
17.5.9. If the computer is switched on and connected to a network, the investigating officer to secure the services of a forensic examiner to capture the volatile net work data like IP address, actual net work connections, net work logs, etc., 17.5.10. The MAC address also to be identified and secured.
17.5.11. In the unlikely event of the Forensic examiner not being available, then unplug the computer, pack the computer and the wires in separate faraday covers after labeling them. 17.5.12. In case of a laptop if the removal of the power cord does not shut down the laptop to locate and remove the battery. 17.5.13. If the laptop battery cannot be removed, then shut down the laptop and pack it in a faraday bag so as to block any communication to the said WP No.11759/2020 laptop since most of the laptops, nowadays have wireless communication enabled even when the laptop is in the stand by mode.
17.6. Seizure of networked devices: Apart from the above steps taken as regards seizure of the computer, laptop, etc., if the said equipment is connected to a network:
17.6.1. To ascertain as to whether the said equipment is connected to any remote storage devices or shared network drives, if so to seize the remote storage devices as also the shared network devices.
17.6.2. To seize the wireless access points, routers, modems, and any equipment connected to such access points, routers, modems which may some times be hidden.
17.6.3. To ascertain if any unsecured wireless network can be accessed from the location. If so identify the same and secure the unsecured wireless devices since the accused might have used the said unsecured wireless devices. 17.6.4. To ascertain who is maintaining the network and to identify who is running the network - get all the details relating to the operations of the network and role of the equipment to be seized from such network manager.
17.6.5. To obtain from the network manager, network logs of the machine to be searched and/or seized so as to ascertain the access made by the said machine of the net work.
17.7. Mobile devices:Mobile devices would mean an include smartphone, mobile phone, tablets GPS units, etc., during the course of seizure of any of the mobile devices, apart from the steps taken in respect of a computer and/or laptop, the following additional steps to be taken:
17.7.1. Prevent the device from communicating to network and/or receiving any wireless communication either through wifi or mobile data by packing the same in a faraday bag.
17.7.2. Keep the device charged throughout, since if the battery drains out, the data available in the volatile memory could be lost.
17.7.3. Look for slim-slots remove the sim card so as to prevent any access to the mobile network, pack the sim card separately in a faraday bag.
17.7.4. If the device is in power-off mode, the battery could also be removed and kept separately.
17.7.5. If the device is powered on, then put it in an aeroplane mode in android device or airplane mode in a IOS device.
17.8. In all the cases above, the seized equipment should be kept as far as possible in a dust- free environment and temperature controlled. 17.9. While conducting the search, the investigating officer to seize any electronic storage devices like CD, DVD, Blu-Ray, pen drive, external hard drive, USB thumb drives, solid-state drives etc., located on the premises, label and pack them separately in a faraday bag.
17.10. The computers, storage media, laptop, etc., to be kept away from magnets, radio transmitters, police radios etc., since they could have an adverse impact on the data in the said devices.
17.11. To carry out a search of the premises to obtain instructions manuals, documentation, etc., as also to ascertain if a password is written down somewhere since many a time person owning equipment would have written the password in a book, writing pad or the like at the said location.
17.12. The entire process and procedure followed to be documented in writing from the time of entry of the investigation/search team into the premises until they exit.
Karnataka High Court
Read full Judgment here: Click here
No comments:
Post a Comment