1. Intake
- Photograph the exhibit on receipt; note make, model, serial number, condition and accessories.
- Assign a unique exhibit number and open a chain-of-custody record.
- Sign and time-stamp every transfer of custody.
2. Acquisition
- Use validated forensic tools (e.g. Cellebrite, Oxygen, Magnet, Belkasoft, X-Ways).
- Apply write-blockers for storage media where supported.
- Generate cryptographic hashes (SHA-256 minimum) of acquisitions and verify on every copy.
3. Storage
- Exhibits stored in a locked, access-controlled evidence area at our Southport premises.
- Digital images stored on encrypted, access-controlled storage in Australia.
- Access is restricted to authorised personnel and logged.
4. Analysis
Analysis is conducted on working copies, never the original. Notes record the tools, versions and steps used so the work is reproducible by a second examiner.
5. Reporting and disclosure
Reports state the scope, methodology, findings, limitations and any assumptions. Exhibits and working data are made available to opposing experts on appropriate undertakings.
6. Return or destruction
On completion, exhibits are returned to the Client and data is retained or destroyed in line with our Data Retention and Destruction Policy.