⚠ Unofficial machine translation of the Italian original, produced for this restore — not by AvANa. For anything safety-critical, refer to the Italian version. Italian original.

This describes ITALIAN law only. It covers what to do during a seizure of computer equipment under Italian criminal procedure. It does not describe your rights elsewhere — police powers, what you must hand over, and the rules on expert examination differ substantially between jurisdictions. For other jurisdictions see: United States · Spain (in Spanish). Do not rely on this page outside Italy; consult a lawyer in your own country.

Legal

Restored from the project wiki (we.riseup.net), which is no longer online.

What to do during a seizure of computer equipment?¶

During a seizure it is worth paying attention to a few details:

Check that seals are placed on the computers at the end of the seizure (all seized material must be transported sealed) and if this does not happen, ask for it to be recorded in the report.
Ask for a party-appointed expert to be present at the seizure. Anyone can act as one (obviously a computing background helps with credibility).
Ask for a lawyer to be present.
If you are asked for your passwords you are not obliged to give them. Not remembering is better than refusing and taking a hostile stance. Bear in mind, however, that if the computer is not encrypted, some passwords will be broken extremely easily straight after the seizure – for example the Windows login one.
If your computer is already switched on and is used by the police or by experts during the seizure, ask for it to be recorded in the report. All the more so if it was switched off and is then switched on.

Forensic examination¶

At the end of the seizure all the digital material will be analysed by a forensic technician. At this stage it is possible to:

Appoint a party-appointed expert and take part in the “acquisition” procedures (the forensic copy of your data) in order to check that they are carried out correctly.

Repeatable and non-repeatable evidence:

If the acquisition is carried out under article 359 of the Italian code of criminal procedure (c.p.p.), it is repeatable. The CTP (party-appointed technical consultant) will therefore be able to carry out the examination again on a forensic copy.

In some cases (smartphones or other devices) it is not possible to make a forensic copy of the data, so the analysis is carried out – under article 360 c.p.p. – directly on the original medium and cannot be repeated by the CTP (party-appointed expert). The presence of a CTP becomes particularly important in these situations because, since the analysis cannot be repeated, the only way to make sure the operations were carried out correctly is to be present at them.

What to do when the material is released?¶

Requesting the forensic copy acquired by the police is a very expensive procedure that can end up costing thousands of euros.
Unfortunately, though, if a counter-examination has to be carried out, the CTP (party-appointed technical consultant) must be able to have a copy to work on.
Once the material has been released (if you avoid using the computer), you have the original material used by the CTU (court-appointed technical consultant) to create the forensic copy that will be analysed. This means that the CTP (party-appointed technical consultant) can go ahead with a new acquisition using our computer, thereby saving us from having to spend a lot of money needlessly.

It is therefore important NOT to use the computer that has just been released.

It is then possible to verify, using particular tools, that the copy made by the CTP is identical to the one used by the CTU and therefore usable for carrying out the counter-examination.

In addition, carrying out a further forensic acquisition – especially if you were not present at the acquisition procedures carried out by the CTU – is also useful for working out whether the computer has been tampered with, or whether the acquisition procedure was carried out in an anomalous way.