Professional Documents
Culture Documents
SOP On Digital Evi - Kerala Police
SOP On Digital Evi - Kerala Police
DIGITAL EVIDENCE
RELATED TO CRIMES AGAINST
WOMEN AND CHILDREN
PREFACE
Justice C.N. Ramachandran Nair
Commission on Police and Prisons Reforms has
recommended that the digital evidence,
especially that which related to crimes against
women and children, are to be collected
immediately (or as early as possible) and then,
preserved scientifically because any delay or
lapse in the collection and preservation of
these digital materials can result in the
unavailability of some valuable digital
evidence of the perpetrator’s criminal activities
and so, can be ultimately unhelpful to the victims.
In this connection we have issued, time and again, various
instructions and those have to be complied with. However, we don’t have
a consolidated SOP.
Therefore, I directed to prepare a Standard Operating Procedure
(SOP) which will help the investigators to follow proper procedure in
collection of digital evidence, to collate them and present them before
Courts. Sri. S.Sreejith IPS, ADGP Crimes; Sri. Kori Sanjaykumar Gurudin
IPS, DIG TVPM Range and Sri. E.S.Bijumon, Addl. SP, Hi-Tech Cell, PHQ
have done excellent work in comprehensively preparing the SOP.
I compliment the Officers for their work of diligence, sincerity, skill and
knowledge.
I am sure this SOP will be very useful to one and all and these
procedures are to be followed by the concerned Police Officer. As the
technology is changing, there will be a requirement to change the SOP
over the period of time. Therefore, the Nodal Officer of the Cyberdome,
ADGP of the Crime Branch and the Chief of the Kerala Police Hi-Tech
Cell, PHQ must issue timely amendments and make necessary changes as
per requirement.
GENERAL CONTENT
Sl. Page
TITLE
No. No.
1 Introduction 1-5
Conventional crimes against women and children
Cyber harassment against women and children
What are digital evidence & the nature of digital evidence?
Advantages of digital evidence
3 24-27
Collection of digital evidence
Procedure for gathering evidences from switched-off
systems
Procedure for gathering evidences from live systems
(Switched- on Systems)
Procedure for gathering evidences from Mobile Phones
Local Area
Network (LAN) The device itself and also MAC
8 Card or Network (Media Access Control) address
Interface Card can be obtained.
(NIC)
• Interview
• Identify
• Document
1. IDENTIFICATION • Revise If Necessary
• Measure twice, Cut Plan the CSI
once
Prepare document
Prepare
Prepare
Secure premise
Identify evidence
Discuss strategy
Collect evidence
3. ANALYSIS Photograph
Package evidence
Transport
Transport
Drive Imaging
Chain of Custody
5. PRESENTATION
Interview
Identify
Step No.1
Document
IDENTIFICATION
Revise If
Measure twice,
Cut once
Prepare
PREPARE
Prepare
Secure premise
Identify evidence
CONDUCT Document
Conduct short
Step No.2
COLLECTION Discuss strategy
among team
Collect Evidence
COLLECT
Label Evidence
Photograph
Package
TRANSPORT
Transport
Where
• Where was it found? Where did
When
• When was it created, accessed, modified, received, sent, viewed,
deleted and launched?
• Does it show when relevant events took place?
ANALYSI
How
• How did it originate on the media?
• How was it created, transmitted,
Other connections
• Do the above artifacts and metadata suggest links to any
other items or events?
Step No. 5
PRESENTATION
Tips To Prepare For Deposition of Evidence in Court
The Investigating Officer should prepare well to depose the evidence in
the court of law like any other case. All the digital evidences will be
presented as exhibits and introduced as evidence to establish the process
used to identify, collect, preserve, transport, store, analyze, interpret,
attribute, and/or reconstruct the information.
Re-constructing the scene of offence and the cyber-crime with the
sequence of actions by each system and user is very important in the
deposition.
To depose the evidence, Investigating Officers are requested to
prepare their notes in the below order.
• Complaint received
• Collected relevant information
Checklist:
The list of actions below should be followed when retrieving video data
to ensure that all relevant video and information about the system is gathered.
This is essential to permit future viewing and maintain evidential integrity, whilst
minimising any potential disruption to the premises where the CCTV system is
installed.
2. Note the make and model of the CCTV system, and the number of
cameras. Take photographs of the system if possible, particularly if the
recorder is unfamiliar or the manufacturer uncertain.
3. Note the basic system settings (e.g. current record settings and display
settings), so that if changes have to be made to facilitate the retrieval,
it is then possible to return the system to its original state. (Taking
photographs of the system can assist, particularly if cable connections
are changed during retrieval).
6. Determine which camera views are required, and whether they can be
retrieved separately. It is good practice to draw a plan of the camera
views to facilitate further decision making processes. Depending on the
nature of the incident, there might, for example, be a requirement to
retrieve all cameras with external views. Some systems permit video
from individual cameras to be downloaded, but some do not, in which
case data from all cameras will need to be taken. The decision taken
and the reasons for it should be documented in the audit trail.
7. Replay Data. Check that the requested video exists on the system.
10. The recording should not be stopped during the retrieval process
unless
13. The IO can seize the entire DVR/NVR (preferable due to propriety
software), or can collect the relevant part of recording from the
owner/operator/ technicianalong with a 65 B(4) Certificate.
NB: The person issuing the 65 B(4) Certificate must be aware of the
details, file formats, installation details and specifications of the
device.