Examination lab
Procedures (SOPs)
A standard operating procedure is a repeatable sequence that keeps evidence sound and the work documented. Each one lists its steps, the record every step leaves behind, the forms it uses, and the mistakes it guards against. They describe how evidence is handled and documented, not how device security is bypassed.
SOP-01
First response at the scene
Securing, documenting and seizing devices
How to secure a scene, document every device in its found state, decide between live collection and shutdown, and package items without losing data.
SOP-02
Evidence intake and registration
Receiving items into the laboratory
Receiving items into the laboratory: checking seals, verifying the inventory, assigning identifiers, photographing and storing, and recording the request.
SOP-03
Chain of custody
Unbroken record of possession
Maintaining a continuous, signed record of who held each item, when and why, from seizure through examination to return or disposal, including digital copies.
SOP-04
Disk imaging and verification
Bit-for-bit copies with proof
Creating a verified forensic image of storage media: write protection, tool and format, acquisition and verification hashes, errors, encryption and SSDs.
SOP-05
Mobile device acquisition
Isolation, extraction type, verification
Documenting a phone's state, keeping it isolated, choosing and recording the extraction type, hashing the archive and noting what the extraction cannot contain.
SOP-06
Live response and volatile data collection
Order of volatility in practice
Collecting memory and running-state data from a powered system in a defined order, with trusted tools, minimal footprint and a log of every action.
SOP-07
Cloud and email preservation
Holds, exports and hashes under authority
Preserving provider-side evidence: applying holds, extending retention, exporting logs and content with full fidelity, and hashing every export.
SOP-08
Examination notes and working record
Contemporaneous, complete, reproducible
Keeping contemporaneous notes of every examination step, tool, parameter and decision, so that another examiner can reconstruct and repeat the examination.
SOP-09
Reporting and peer review
From notes to a report another examiner has checked
Writing the report from the examination notes, separating observation from opinion, stating confidence and limits, and having a second examiner verify findings.
SOP-10
Laboratory quality and tool validation
Why the results can be trusted
The quality system behind the procedures: tool validation, dual-tool checks, competence records and non-conformance handling, in the logic of ISO/IEC 17025.