GUIDELINES FOR DIGITAL FORENSICS FIRST RESPONDERS Best practices for search and seizure of electronic and digital evidence March 2021 01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010 101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€0101010 010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥0101 0101010101$10101010101010101¥01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€010101010101 01¥010101010101012 $01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101 01010101$01010101010101 €01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01 Disclaimer These “Guidelines for Digital Forensics First Responders” (the “Guidelines”) have been prepared as technical guidelines to provide information and advice on digital forensic approaches that may be adopted when seizing and analysing different kinds of devices. These Guidelines are solely for the use of law enforcement professionals having the necessary legal basis or authorisation to perform the actions described herein. The legal, procedural and customary frameworks in respect of search, seizure, chain of custody, analysis, reporting, submission in criminal/prosecution/judicial process, evidentiary evaluation, admissibility and probative value, etc., differ widely by jurisdiction. These Guidelines do not provide any recommendations, advice or instructions in respect of requirements under such legal and procedural frameworks in any jurisdiction and any references seemingly suggesting as such should be read as being subject to domestic laws and procedures in this regard. Readers are advised to ensure, when taking any actions based on these Guidelines, to verify and be satisfied that such actions are in compliance with appropriate legal and procedural requirements or standards in their jurisdictions. These Guidelines are not mandatory in nature and have no enforceability. INTERPOL shall not be liable for any actions taken by any parties based on these Guidelines which are contrary to or inconsistent with or not in compliance with any relevant legal, regulatory, administrative, procedural, evidentiary, customary, or other requirements, exhibit extraction processes, chain of custody records to be maintained, etc. These Guidelines also include mentions of open source, proprietary and publicly available tools and services (collectively, the “Tools” and each, a “Tool”) that offer various functionalities. They may be viewed, downloaded and/or used at the discretion of the user. In relation to these, please note the following: INTERPOL has not developed or verified the Tools, does not endorse them, has no association with their providers, and does not license or provide any support for the use of such Tools. INTERPOL provides no warranties (express or implied) in relation to the Tools or any of them, their utility for any purpose or effectiveness. Links to other websites from these Guidelines do not constitute an endorsement by INTERPOL, and are only provided as a convenience. It is the responsibility of the user to evaluate the content and usefulness of information obtained from other websites/ using these Tools. INTERPOL does not control, monitor or guarantee the contents of the links or the Tools provided herein, or their data collection practices; it does not endorse any views expressed or products or services offered therein. 01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010 101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€0101010 010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥0101 0101010101$10101010101010101¥01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€010101010101 01¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥3 01010101 01010101$01010101010101 €01010101010101¥01010101010101$01010101010101€01010101010101 ¥01010101010101$01010101010101€01010101010101¥01010101010101$01 Disclaimer t may be necessary to create user accounts, pay subscription or one-time fees or upgradation fees in order to use some of these Tools. Reistration or creation of user accounts, payment These “Guidelines for Digital Forensics First Responders” (the “Guidelines”) have been prepared as of fees or chares may reuire authorisation from your oranisation and be subject to leal technical guidelines to provide information and advice on digital forensic approaches that may be reuirements in your urisdiction (including for the creation of fae or assumed identities for adopted when seizing and analysing different kinds of devices. These Guidelines are solely for the use this purpose). Please ensure that you have the reuisite authorisations to use the Tools. of law enforcement professionals having the necessary legal basis or authorisation to perform the INTRPOL does not encourae or in any manner, authorise doing so, and ill not be liable in actions described herein. respect of any actions you tae to create accounts or reistrations, pay any fees or subscriptions, or if you assume any identities or create fae credentials, in order to use any The legal, procedural and customary frameworks in respect of search, seizure, chain of custody, Tool. analysis, reporting, submission in criminal/prosecution/judicial process, evidentiary evaluation, admissibility and probative value, etc., differ widely by jurisdiction. These Guidelines do not provide ach of these Tools may be subect to licenses, privacy policies and to the terms contained any recommendations, advice or instructions in respect of requirements under such legal and therein. Please revie carefully any such terms, conditions or privacy policies that apply to procedural frameworks in any jurisdiction and any references seemingly suggesting as such should be the use of any Tool you ish to use. read as being subject to domestic laws and procedures in this regard. nformation entered into any of the Tools may be saved on the servers of the company that Readers are advised to ensure, when taking any actions based on these Guidelines, to verify and be provides the Tool, and the leality of this ithin your jurisdiction must be tested and verified satisfied that such actions are in compliance with appropriate legal and procedural requirements or by you. t is also the responsibility of the user to test the data collection practices and privacy standards in their jurisdictions. policies of the Tools as aainst their national leal requirements. These Guidelines are not mandatory in nature and have no enforceability. INTERPOL shall not be liable ny use of the Tools (or any of them) is at your on ris, and TERPOL shall not be liable or for any actions taken by any parties based on these Guidelines which are contrary to or inconsistent responsible under any circumstances for any damae or loss incurred, caused or alleed to be with or not in compliance with any relevant legal, regulatory, administrative, procedural, evidentiary, caused due to your use of or reliance upon any of these Tools. ny claims or actions in relation customary, or other requirements, exhibit extraction processes, chain of custody records to be to any damae or loss incurred by a user should be directed to the providers of the Tool(s) maintained, etc. and not INTRPOL. These Guidelines also include mentions of open source, proprietary and publicly available tools and No data that is input in the use of any of these Tools will be transmitted to or be available to services (collectively, the “Tools” and each, a “Tool”) that offer various functionalities. They may be INTRPOL in any ay. hould you choose to use any of the Tools for forensic, analytical or viewed, downloaded and/or used at the discretion of the user. In relation to these, please note the investigative purposes, you acnolede that TERPOL shall not receive any information in following: this reard, and at no point ill be in the chain of custody of any evidence analyed or generated using any such Tool. INTERPOL has not developed or verified the Tools, does not endorse them, has no association with their providers, and does not license or provide any support for the use of such Tools. INTERPOL provides no warranties (express or implied) in relation to the Tools or any of them, their utility for any purpose or effectiveness. Links to other websites from these Guidelines do not constitute an endorsement by INTERPOL, and are only provided as a convenience. It is the responsibility of the user to evaluate the content and usefulness of information obtained from other websites/ using these Tools. INTERPOL does not control, monitor or guarantee the contents of the links or the Tools provided herein, or their data collection practices; it does not endorse any views expressed or products or services offered therein. 01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010101€01010101010101¥01010101010101$01010101010