CMK Article 134, the slightest procedural error in the search for digital evidence refutes all evidence; Peace penalty approval + live analysis + hash chain + expert report is mandatory.
CMK art.134 — computer search procedure
Hash chain
- MD5: Old; risk of conflict today; alone is insufficient.
- SHA-256: Standard; Mandatory for expert reports.
- SHA-3: New generation; It is preferably used.
- Hash comparison at each stage (seizure, clone, review); incompatibility = evidence decays.
Typical procedural errors (cancellation of evidence)
- Magistration approval missing (emergency exception proof missing).
- Do not call before a lawyer is called.
- No hash timestamp.
- Examination without making clones.
- Inability to appoint experts (uncertified).
- The device was kept on, RAM was lost.
Expert report content
- Device identification (brand, model, serial, IMEI).
- Seizure date and hash.
- Clone method.
- Analysis tool (FTK, Encase, Magnet AXIOM).
- Findings (folder, file, application, log).
- Hash comparison result.
- Expert signature and certificates (CHFI, EnCE, GCFE).
Frequently asked questions
The client erased his device; Will it come back?
Software deletion is at the file system level; data may still be on disk. It can be recovered with a forensic tool (FTK, Recuva pro). If it is a full disk wipe (such as DBAN), it will not come back.
What happens if there is a hash mismatch?
The integrity of the evidence was broken; the court rejects. This is a very strong argument in the opposing rebuttal strategy. The hash steps should be clear in the expert report.
The device is encrypted, cannot be opened; what to do?
CMK article 134/4 — not obliged to give password (right not to testify against oneself). State breaking techniques (brute-force, exploit, vendor request). Apple needs a request MLAT procedure.
Why is RAM analysis important?
There may be open passwords, cracked files, and connection sessions in RAM. It clears RAM when the device is turned off; live analysis (volatility, FTK Imager) is mandatory.
How do we refute the expert report?
Hash chain break, uncertified expert, incomplete methodology, parallel report (defense forensic expert), petition of objection + technical question at the hearing.
Relevant legislation
- HMK art.199-205 — Presentation of documents and evidence.
- HMK art.400-405 — Determination; with witness / expert.
- CMK art.134 — Computer search, copying; hash chain.
- TCK art.243-245 — Computer crimes, digital evidence chain.
- e-Signature Law (5070) — Electronic signature and time stamp.