Session 8 - Phase 1: Investigation phase

Session objectives: 

• Investigate hand-on all traces;
• Evaluate warrants and production orders to be taken; 
• Initiate mutual legal assistance where needed;
• Requesting expert-witness assistance (IT-expert or LE-officer); 
• Seizure of electronic evidence;
• Transborder electronic evidence gathering;
• Dealing with electronic evidence in webmail, social media, cloud storage, darkweb;
• Dealing with house searches and electronic evidence found during them: open accessible cloud storage, smartphones (which are locked), the seed of a virtual currency wallet;
• Taking decisions on seizure, live forensics or dead forensics; 
• Rule of law aspects (forcing someone to enclose electronic evidence?);
• Ordering witness interviews; 
• Public-private cooperation;
• Dealing with data retention restrictions, domestic and internationally.