Karnataka HC Issues Guidelines For Search Of Electronic Devices

The Karnataka High Court has issued guidelines to be followed by investigating officers regarding the manner of carrying out a search and/or for preservations of the evidence gathered during the said search in respect of smartphone, electronic equipment or email account. These guidelines were given in the case of Mr Virendra Khanna vs State of Karnataka.

When a search is carried out by an Investigating Officer, it is required for the Investigating Officer or the search team to carry out the search in a proper and effective manner. Apparently there are no rules formulated by the police department regarding the manner of carrying out of a search and/or for preservations of the evidence gathered during the said search in respect of smart phone, electronic equipment or email account. The guidelines are as follows:

In the case of a personal computer or a laptop:

When carrying out a search of the premises, as regards any electronic equipment, Smartphone or e-mail account, the search team to be accompanied by a qualified Forensic Examiner.
When carrying out a search of the premises, the investigating officer should not use the computer or attempt to search a computer for evidence.
The usage of the computer and/or search should be conducted by a properly authorized and qualified person, like a properly qualified forensic examiner.
At the time of search, the place where the computer is stored or kept is to be photographed in such a manner that all the connections of wires including power, network, etc., are captured in such photograph/s.
The front and back of the computer and/or the laptop while connected to all the peripherals to be taken
A diagram should be prepared showing the manner in which the computer and/or the laptop is connected.
If the computer or laptop is in the power-off mode, the same should not be powered on.
If the computer is powered on and the screen is blank, the mouse could be moved and as and when the image appears on the screen, the photograph of the screen to be taken
If the computer is powered on, the investigating officer should not power off the computer.
As far as possible, the investigating officer to secure the services of a computer forensic examiner to download the data available in the volatile memory i.e., RAM since the said data would be lost on the powering down of the computer or laptop
If the computer is switched on and connected to a network, the investigating officer to secure the services of a forensic examiner to capture the volatile network data like IP address, actual network connections, network logs, etc.,
The MAC address also to be identified and secured.
In the unlikely event of the Forensic examiner not being available, then unplug the computer, pack the computer and the wires in separate faraday covers after labelling them
In case of a laptop if the removal of the power cord does not shut down the laptop to locate and remove the battery.
If the laptop battery cannot be removed, then shut down the laptop and pack it in a faraday bag so as to block any communication to the said laptop since most of the laptops, nowadays have wireless communication enabled even when the laptop is in the standby mode.

Seizure of networked devices:

Apart from the above steps taken as regards seizure of the computer, laptop, etc., if the said equipment is connected to a network, then the following guidelines are required to be followed:

To ascertain as to whether the said equipment is connected to any remote storage devices or shared network drives, if so to seize the remote storage devices or shared network drives, if so to seize the remote storage devices as also the shared network devices.
To seize the wireless access points, routers, modems, and any equipment connected to such access points, routers, modems which may sometimes be hidden.
To ascertain if any unsecured wireless network can be accessed from the location. If so identify the same and secure the unsecured wireless devices since the accused might have used the aid unsecured wireless devices
To ascertain who is maintaining the network and to identify who is running the network – get all the details relating to the operations of the network manager
To obtain from the network manager, network logs of the machine to be searched and/or seized so as to ascertain the access made by the said machine of the network

In Case of Mobile Devices:

Mobile devices would mean an include smartphone, mobile phone, tablets GPS units, etc., during the course of seizure of any of the mobile devices, apart from the steps taken in respect of a computer and/or laptop, the following additional steps to be taken:

Prevent the device from communicating to the network and/or receiving any wireless communication either through wifi or mobile data by packing the same in a faraday bag
Keep the device charged throughout, since if the battery drains out, the data available in the volatile memory could be lost.
Look for slim-slots, remove the sim card so as to prevent any access to the mobile network, pack the sim card separately in a faraday bag.
If the device is powered on, then put it in an aeroplane mode in android device or airplane mode in an IOS device.
In all the cases above, the seized equipment should be kept as far as possible in a dust free environment and temperature controlled.
While conducting the search, the investigating officer seized any electronic storage devices like CD, DVD, Blu-Ray, pen drive, external hard drive, USB thumb drives, solid-state drives etc., located on the premises, label and pack them separately in a faraday bag.
The computers, storage media, laptop, etc., to be kept away from magnets, radio transmitters, police radios etc., since they could have an adverse impact on the data in the said devices.
To carry out a search of the premises to obtain instructions manuals, documentation, etc., as also to ascertain if a password is written down somewhere since many a time person owning equipment would have written the password in a book, writing pad or the like at the said location.
The entire process and procedure followed to be documented in writing from the time of entry of the investigation/search team into the premises until they exit.

It would be in the interest of all the stakeholders that detailed guidelines are prepared by the police department for the same.

Subscribe to Whats App Updates