Incorrect handling of digital forensic evidence could affect the outcome of a successful investigation and prosecution. Follow these simple steps before contacting the DFU.
STOP! Don't touch
- Never attempt to corroborate the accusation by having 'a quick look'. This may jeopardise the evidence and possibly rule it inadmissible in formal proceedings.
Remember that computers and other electronic devices record everything, including who logged on and when. If the subject can show that their computer was accessed at a time when they were not present, they may claim that evidence found therein was put there by someone else.
Act fast!
- Time is of the essence when it comes to digital evidence. Get advice as soon as you become aware of the situation. The Digital Forensics Unit (DFU) can advise you on what your next steps should be.
- Contact the DFU straight away! Besides NHS Counter Fraud Authority's own investigations, the DFU can provide digital forensics and other services for any NHS investigation carried out by an authorised person.
Please contact us using the details below, or visit the DFU pages for more information.
Email: forensics@nhscfa.gov.uk
Get advice!
- You can call the Digital Forensics Unit (DFU) for free and impartial advice. Every situation is different and requires individual assessment. Experienced senior digital forensics investigators will give you advice on the best strategy to adopt in your unique situation.
- Furthermore, you should get legal advice on current legislation and ensure you know your organisations policies and procedures. Your organisations legal/policy representative and HR department should be able to provide this advice.
- Before you do anything else, your best strategy is to pick up the phone.
Keep it confidential!
- Do NOT discuss the matter with anyone who does not need to know. Other parties may be involved that you are not aware of yet, and your subject may have connections or relationships with colleagues that you are not aware of.
Transferring any kind of digital media across internal networks or the Internet may not be secure. Make sure that any files you do send are fully encrypted with a data transfer service such as Egress Switch
Things to remember
- At the earliest opportunity in you investigation you should ask for passwords, login details, and mobile phone PIN codes where available. In some circumstances we will not be able to examine a device without these.
- If a device is switched on the general rule of thumb is, pull the plug or if this is not possible power of by holding the power button and removing the battery. If you are unsure of what steps you should take, contact the Digital Forensics Unit immediately
- Securely seal any seized items in an appropriate evidence bag/box to maintain evidential integrity and chain of custody.