POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
_— Seectatoic Royal al Grup
What You Will Learn
After completing this module, you wil beable to:
+ State the grounds for conducting a seach and what your
powers are,
+ Record recovered property and maintain continuity of I
evidence,
+ Explain Group Security policy in respect of searches including I
Health and Safety issues,
+ State what powers of search the Police possess,
+ Describe how you apply for a Search Warrant,
+ Explain the correct treatment of computer evidence,
+ Explain the 65027 procedure,
As stated earlier, some issues regarding searching are referred to in
the PACE COP module, Therefore, some ofthe ebove objectives will
be achieved in conjunction with studying that module,
Click Next to continua, Back {01 of I Hext
Pik
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page I of 1
Searching With Consent Select atope ee Royal Mail Group
Grounds for Search
Before a search is conducted, there must be reasonable grounds for
thinking that the suspect has committed an offence, and that they
are in possession of stolen property, or that they could be in
possession of anything obtained as a consequence of an offence,
Search Click Nexto continue, Bac fof o7I Next
Pint
— I I
3] taoducontotvestgans 8 hi Ea I
!
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page I of 1
Searching With Consent _ Select atopic YD Payal Mal Group
Powers of Search
Investigation Managers have no statutory power of search, and itis
important to avoid creating any misapprehensions on this point
vwhen dealing with suspected offenders,
Inthe absence of search warrant, an Investigation Manager may
search a suspected offender, their private motor vehicle and their
Home, but only if that person's written consent as been obtained,
Additionally, the person searched must be told that they are nat
obliged to consent toa search, and that, if anything is setze, t may
be used in evidence,
Consent also needs to be obtained before a search ofa personal
locker can be caried out. However, if this consents nat glen, the
ffcal locker canbe searched on the basis that tis the property of
Royal Nail Group,
A universal search consent form, GS005, should be completed
and signed prior to all searches,
Click on the blue text to lear more,
Click Next to continue,
Pitt
ii] Introduction to Investigations
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Searching With Consent Royal Mail Group
Notice of Powers and Rights Form GS004
Prior to the search of premises and vehicles, the suspect must aso
be handed a Notice of Powers and Rights form $004, Ths form
eaplans what the individual rights are when a request to search
their premises has been made,
IF the suspects not the over or tenant of the property to be
searched, then you must get the consent of the person whois
entitled to grant entry, and they must sign either form GS00Sa
(vehices) or GS005b (premises),
Click onthe blue text to leam more,
Click Next to continue, 82¢K {03 of 07) Next;
Prk
E}Itiouciontotvestgtins EB t! r & I
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Royal Hail Group
Searching With Consent
Matt
Test Yourself
Answer the fllosing questions, which relate to the GSOO4 form
you have just read, Tick the answer/s you believe to be right, I Correct!
Ifa suspects ving in rented accommodation and isnot avaiable, Ifa suspects Iving in rented
Can an Investigation Manager obtain consent from the Landlord to accommodation and isnot avalabl,
search the premises? an Jnvestigation Manager cen obtain
consent from the Landlord to search
Choose the comect option and lick on Submit the premises,
0 Yes
Qt
Search Ci Netto cine, 22 [ef] Net
Pink
- I!
ES] nodudonto vestigations A dl 2 a
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions
Searching With Consent
Test Yourself
\ here can a suspect obtain a copy of the PACE Code of Practice
relating tothe search and seizure of property?
Choose the two correct options and dick on Submit,
(if tac tin
0 Personnel Department
Wy Investigation Manager's Office
(aay otto fice
0 Royal ail Legal Services
Search
__ Selecta topic. AAD Royal Hal Group
Page I of 1
[oo
I Correct!
Poe ~
Asuspect can obtain a copy of the
Code of Practice relating tothe search
and seizure of property from a Patce
Station or the Investigation
Manager's Ofice.
GiekNextto cone, B30 of Next
Part
fl Introduction to Investigations
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Searching With Consent a _ Sectatope I Royal Mail Group
Test Yourself
What needs to be entered tthe boom of the 65004 form before it ——_
is given tothe suspect? Correct!
i
Choose the correct option and cick Submit, Your Buses Untsadress musthe .
eailered atthe bottom of the 65004
() The suspect’ name fo before itis vento the suspect
© Your usiness nits adress
() The name of the Investigation Manager
() The aderess of Royal al Lega Services
Click Heat to continue, Pack [06 of 7 Next I
Pink
ES] noducion to tvestnatins g } 2 oe
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page I of 1
” Seket atopic “DD taattetnp
Searching With Consent
Test Yourself
What sa suspect ented to have on request, if property is kept {
by an Investigation Manager folowing a search? I Comect
}
Chcose the correct ogtin and cick Submit Assuspectis entitled to havea ist
escbng the property if tis kept by
0 List desarbing the property an Investigation Manager flbinga
search,
Q conpensation ote seizure
() Access tote property bet isteken aay
Click Next to continua, _Back {07 of 07) Next ‘
Prat
I Introduction to Investigations B dI 2 &
hitp/faxcont68 sabahosted.com/content2/eninv000000000007412/htmi_scorm_12/¢0., 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Treatment of Recovered Property ; Selecta topic q Royal Mail Group
Recording of Property
Arrecord of each search must be made on a form G$005c and
Cltails of any property seized recorded on a form GS005¢, using
more than one form if necessary,
Investigation Managers undertaking searches must also take with
them item labels (they are labels but have a form number S035)
and item bags (also known as exhibit bags) which are indifferent
sizes,
Click on the blue text to leam more.
ot
Click on the image to lear more.
Search Back oats! Het
i Introduction to Investigations
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions
Page 1 of 1
Treatment of Recovered Property
Recording of Property
Arrecord ofeach search must be made on a form GS00Sc and
details of any property seized recorded on a form GS005d, using
more than one form if necessary,
After Seizure
Lu J ith
)
Innmediately an item is seized during a search: pet
1, TEmust have an item label attached or be placed into
an exhitit bag,
2. The nals ofthe Investigation Manager meking the
sezure and a sequential number must be recorded on
the exhibit bag by way of an identiying mark (for
example, BC/1, BC/2 etc.)
3, These deta must then be besfeed to the Read
Prop Sed fom, GSS
4, The finder must initial the search form entry to
acknowledge thatthe entry has been recorded cored,
Select a topic
Royal Mail Group
Click on the image toleam mere,
Click Nextt continue, _Back {02 of 08; Next
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Selecta toi UY toattatcray
Treatment of Recovered Property
Storage of Recovered Property
Itis essential that property recovered at searches, and indeed any iy
other items that may be exhibits ina prosecution, are stored safely, 7 ¥
Each Investigation Manager has access to a Secure area where ’ ‘
ents canbe stored, In adn tothe Ky Hl by he «\
Investigation Manager forthe secure area, a spare should be held L
bythe Line Manager, :
If exhibits have tobe removed for any reason a record must be row
Kept for continuity purposes, shoving who was in control of the ls Y
item at all times, “oe
If an tem s removed from the secure area to be sent somewhere .
else (possibly forthe purpose of obtaining a witness statement), whey I
this must take place by hand to hand transfer or the use of the { Hi i f
Spedal Delivery sevice, again to ensure that continuity of control
Can be demonstrated in Court if necessary.
Click Next to continue, .B2¢k {03 of 8; Next
Pir
J
ES] ncoduton to vestgetins B dl ? &
Search
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Treatment of Recovered Property Selecta topic : Royal Mall Group
Use of Photocopies
Wherever possible, copies should be used to avold the movement of
original exhibits,
Additionally, when submitting case papers, only photocopies of
eatiits should be enclosed, not originals, Where items are too
bulky to copy, suchas large quantities of recovered mal, they
should be retained by the Investigation Manager and town as Yaak
copied" in any list of exhibits, If necessary, arrangements can be
made forthe exhibit in question tobe viewed by interested parties
Such as Royal Mail Legal Services or Defence Lawyers,
+ Summary
’
To summarise the above pins tis esentaltobeatleto Click onthe image to see the summary
proveina Court case thatthe orginl exhibits have been
Kept secure and could not have been tampered wth at any
time, Ifitis essential fr them to be sent elsewhere, full
Continuity must beable to be demonstrate, such asthe
use ofthe Special Delivery service,
Search Click Netto cone, Back [sf Net
Pil
I
ia] Introduction to Investigations E d p &
http://uxcont68,sabahosted.com/content2/cninv00000000000741 2/html_scorm_12/co.... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions
Treatment of Recovered Property
Completion of the Forms
Asa general rule, you should describe the items seized in as much
etal possible, withthe view of indvidvalising the entry,
—
Cickontts bt AFew Other Considerations
at I
In respect of recovered property, there are a few other
Considerations before you touch any items you find,
:
1, Consider ifitis worth taking a photograph, to
cemonstrate the postion ofan item, or in the case ofa
bulk ind, to demonstrate its size. Given as evidence in
Court, a picture can be a far more effective way of
Clserbing a bulk recovery of property, or something
secreted avray, in preference toa writen descrition,
2. Ifyou are teking photographs on private premises, you
should obtzin verbal consent from the property owner
before you doso,
3, Before you touch the item, consider iit could have any
fingerprint evidence which wil be damaged by normal
handling,
Search
Select atopic I
Page 1 of 1
Royal Mail Group
Click on the image to lear more.
VE foSS1ZLe Yon Sone
PYEIS Usstnt Ssuct a
4
& QuanTtina of mace!
Peape M4 Paws Bourse
TUE NUM er OF Irene
leCovertvs
RAW Nt Y HELE Are §
Cogs Wh Be THIS Care 7)
Click Het to continue, Back Js of 0, Hex
Pre WD SHPUET 9 The WY
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
6294)
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions
Page 1 of 1
Treatment of Recovered Property a Selecta topic MAD Royal Mai Group
Test Yourself
Before moving on from the subject of recovered property, please answer the
following questions,
Describe how recovered property must be Kept.
rite your answer inthe textbox. Then dick on Submit,
ina secure location
Search
I Did you get that right?
Alrecovered prety mus beet
in secure conditions (locked cupboard,
oom, etd),
fl Introduction to Investigations
http://uxcont68.sabahosted.com/content2/cninv000000000007412/htmI_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Treatment of Recovered Property AAD Royal Mail Group
Test Yourself
Who should hold a duplicate key to secue areas where exhibits ae stored? f \
I Didyou get that ight?
Thereent Line Herae sh
hold a duplicate key,
Write your answer inthe text box. Then cick on Submit,
your line manager
Search CickNextto cong 22K 07 of Next
Pitt
I
I Introduction to Investigations A di 2 ah
http://uxcont68.sabahosted.com/content2/cninv00000000000741 2/html_scorm_12/co.... 11/02/2011
POL00105437
POLO00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Treatment of Recovered Property - AYP Payal att Group
Test Yourself
Original exhibits are not tobe enclosed in case files, Whats endosed instead?
I Did you get that right?
I :
A good quality A¢ size single-sided
Photocopy should be enclosed instead
Write your answer inthe text box. Then click on Submit. ofthe vital,
Photocopies
Search CickNetto coe, 22k 8 of Net
Pri
—~ I 4
i Introduction to Investigations Bi ug &
http://uxcont68.sabahosted.com/content2/cninv000000000007412/ntml_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions
Health and Safety and General Seach Issues Selecta topic
Health and Safety
To assist your understanding ofthe Health and Safety issues and
the practicalities of searching, please now reads
» The sections on searching within the Group Security
Procedures and Standards document, P&S Doc. 3-X, "Health &
Safety ~ Investigation Duties ~ Hazards & Risks”
* The Group Security handout on the subject, whichis at
Appendix A.
Click on the blue text to leer more,
Search CiekNetto coin, atk [0 0 Nxt
Page 1 of 1
Royal Mail Group
hi Introduction to Investigations
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
bo tay
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1.
Health and Safety and General Search Issues ______ Selecta topic AAD Royal Mall Group
Test Yourself
Thereis a recommended order in which searches shouldbe cared gut Uist =I ~~ ~
what his orders, I Did you get that ight? I
Witz your answer in the tet box, Then click on Submit Searhesshollbeconducedinthe
folowing order
person/locker/car/home
1, Person
2 Locker
3.Vebide
4, Home
Search Cicktento coin, Bz [de et
Pink
I coduton to nvesigaens B i 2 dh
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POLO0105437__
POL00105437
POL00105437
Royal Mail - e Conversions Page I of 1
Heath and Safty and General Seach sues Selecta tic Ayal Mal Group
Test Yourself
What are the rules in respect of your own hands when conducting a search? a
I Did you get that right?
Wit your answer inthe textbox Then cick on Submit. “Ya roster pis of pve ‘
surgical gloves, as ths significantly
you should wear to pars of gloves reduces ther of containation by
I ees compared tothe wearing of
just one pair, During a search, you
should never put your hands where
you can not see, for example down
the back ofsettees, due to the risk of
injury.
Search CickNextto cone, Bk OST Next
Pri
FE) tnvodcionto rvesiatens B dl 2 & {
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions
Health and Safety and General Search Issues
Test Yourself
\ hat is the minimum numberof Investigation Managers that should attend a
premises search, and what role does each have in the search?
Vit your answer inthe textbox. Then dick on Submit.
3octtolook ater the suspect, one to search and one to record exhibits ul
found I
Seltatopc AY) Rye Mai rep
Page I of 1
Did you get that right?
Three is the minimum number of
Investigation Managers that should
attend & premises search - one to act
Sa Chaperone, one to actualy
conduct the search, and the third to
actas an Exhibits Oricer,
Click Next to continue, B2ck [04 of 05; Next
Pik
fi Introduction to Investigations
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
Oo? &l
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Heath and Safely and General Seach Issues Select atopic Ayal Mall Group
Test Yourself
What action should be taken on gaining initial access to the premises to be /
sear? I Did you get that ight?
Mirite your answer in the text box, Then dick on Submit, On odin ery, you tol any
outa check of the premises to
a quick search to see if others are present, if they are discuss this with Hl extableh who present. there s
the suspect plus secure pets jeeps bern
I together. Ifany non-residents are
: there, ask the suspect to request thet
{ they leave the premises, nd
: additionally arrange for any dogs or
{ other pets to be controled, Exglin to
{the people remaining the reasons for
EE] thesearh and bests that the
com is no hostility before commencing the
——~ search Then searcha stele area
and invite the residents to sitin that
area,
Search Click Next to cote, Back}
fl Introduction to Investigations
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Searches Without Consent Selecta tai Royal Nail reup
Suspect Refuses a Request to Search
Investigation Managers have no power to search persons or
premises without consent, If the interviewee asks what will happen
if they do not consent toa search, the Investigation Hanager
should explain tht they would prefer to camry out the search with
consent, as they wish to continue with the investigation, The
interviewee should again be asked whether or not they consent to
the search, and if consents given, it should be recorded in wing
onthe 65005 form,
Inthe event that the interviewee will not give an unambiguous
answer, this should be treated as a refusal to give consent,
Click on the blue text to lear more,
Search Cle ett cet, Pek [of Net
hi Introduction to Investigations
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Searches Without Consent —_ Selecta topic AY Raat rep
Action if Consent is Withdrawn
A search cannot commence or continue once consent has been vo
withdratyn, The interviewee has the right to choose to glve consent to»! ‘
toa partial search (or example, to search certain rooms only), In
arrest will arise, Provided the Investigation Manager has the
necessary power of arrest, they should consider arresting the
interviewee, For more information, check the Powers of Arrest
module,
these cases, only the specie area can be searched unless the / /.
necessary Police assistance is obtained, / f p
I
Ifthe interviewee persists in dedining a search and there is reason ‘ I ya
to think missing property is outstanding, the question of making an tA
CiekNento cut, Ck [0 oft Net
Pi
1
ES) noduien to testatons A rH ? fei
Search
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Searches Mihout Concent _—__ Seca tei TARY toate rp
Police Powers of Search
Once the suspect is under Police ares, the Police may search their
premises without consent under Section £8 of the Police and
Criminal Evidence Act 1984 (PACE),
Section 18 searches are detailed in the PACE COP module, Please
re-read the relevant parts of that module if you are not entirely
lear on this subject,
The Police also have a power of search under Section 32 of PACE,
This allows a constable to search any premises in hich an arrest
takes place, or any place in which the arested person was
immediately before arrest, for evidence of the offence the person
was arrested for, As with Section 18 searches, this topic is covered
in the PACE COP module,
Search warrants and how they affect Investigation Managers are
also covered in the PACE COP module,
Search Cicet toc, Bik [of Net
Pink
HE) tntoducono vss I v ? a
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Searches Without Consent Seketatoe Ayal Mal Group
Legal Privilege
Legal Privilege isthe definition given to communications between a
professional egal advisor and his client in connection with legal
advice,
Items covered by Legal Privilege, as defined in Section 10 of PACE,
cannot be seized during any search by anyone,
Police Officers have other Powers of Entry and Search under
Section 17 of PACE, but these have litle relevance to Royal Mail
Group cases, —
"Tip Zone
Click on the bt
Items held withthe intention of furthering a criminal
F777 I purpose are not subject to Legal Privilege,
!
1
ae
Search ChekNexttcanie, 22 (05008, Net
Pink
ES] nztuton to rvestgatins 8 d p &
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Seta topic QE] uals Group
Seizing Computer Evidence
Seizing Computer Evidences Overview
As computers become more and more a part of everyday fe, itis
expected that the numberof offences involving computers wil
row. The recovery of computer evidence isa specialist area in
which some Investigation Managers have been specifically trained,
(While you are not expected to be an expert in the area of computer
evidence, this section ill give you the basic knowledge required to
ensure thet, when you do seize computer evidence, you do so
comectly, and in a way that will help to maintain the integity of
any potential evidence,
Search Chek Hertto cote, 2k [oO Next
Pri
fl Introduction to Investigations
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page I of 1
Seizing Compute Evidence Selecta topic EY) eal rnp
Seeking Specialist Advice
Ifitis thought that there may be evidence ona computer, then
specialist advice should be sought from the Royal Hall Letters Fraud
Team who deal with computer cme, If appropriate, anangements
can be made for a secure copy of the harddisk to be produced,
You must be able to justify why the seizing ofthe computer is
necessary, particularly itis inthe home and is used by all
members ofthe family, As such a computer should only be seized
where you can justify your bei that contains vital evidence,
The remainder of this section deals with cases where specialist
advice i not avellable, or decision is made on the spot to seize a
Computer at an actual search,
Search Cie etc, 83h [es Net
Pink
ES) ncodueonto investigations I dl 2 & I!
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Seizing Computer Evidence Select atopic Royal Mal Group
How Does a Computer Work?
Before you seize a computer, itis important to appreciate in very
simple terms how a computer works, and the consequence of
incorect handling The diagram of a computer hard disk is
provided for you,
The disk is divided into individual rings called Tracks, and cross-
sectionally into Sectors. Each Sector is capable of storing 542 bytes
of data, One fll page of text corresponds approximately to 1024
bytes (1Kb),
Anvindex ists the location of the data in each Sector, When you
ask the computer to retrieve the letter that you stored as
Memol.doc, for example, the hard disk looks atthe index, finds
where this letter is stored and retrieves it, The letter may have
been stored in one or more Sectors, depending on size,
Click Next to conv, Bat [3 of 05] et
Prat
ES] ioduciontotvestgains 8 ry ? a i
Search
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Seizing Computer Evidence _ Select atopic a iy] Royal Mail Group
Recovering Deleted Data
Wihen a user deletes a file the contents of the deleted file are not last,
The areas of the harddisk the file occupied are simply marked as
available to be "written over" and reused, These deleted files can be
recovered if they are not written over,
I Computers Found Switched Off CLOSE
!
When a computer i switched on, the operating system will = sch ofthe computersin the
automatically wrtea numberof temporery files to the herd ite ine
Cisk as part ofthe start-up procedure, At worst, these
temporary files could write over the “deleted files that hold
the evidence you are seeking, At best, the physical
evidence - the disk - has stil been altered by this action,
Never tum on computer you find ina switched of state
Search Buk [te a
Pil
ES] noducon to tvestgatons A a ? & i
http://uxcont68,sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page I of 1
Seking Computer Evidence Seectatopc Royal Mal Group
Recovering Deleted Data
When a user deletes a file the contents of the deleted file are not lost,
The areas of the harddisk the file occupied are simply marked as
avalable to be “written over" and reused, These deleted files can be
recovered if they are not written over,
Computers Found Switched On
Ifa computer is found on and you switch it ff in the ' Clckon exh ofthe conutersin the
‘hormal way, then again temporary files may writeoverthe
delsted fies as pert ofthe shut dorm procedure theseme —)
thing could happen if you try to print off what is showing I
onthe screen If youfind a computer switched on, you i
should make a notebook entry concerning whats cispayed
cn the monitor, or perhaps consider taking a photograph.
The computer should then be unplugged at the mains -
never Switch the computer off in the normal way,
image to eam more,
Search Click Next to continue,
Part
FE). snveducon to tvestgats BE jl q & I
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions
Seizing Computer Evidence
Current Guidelines
Current guidelines recommend that:
* Allcomponents ofa suspect PC are seize, and if you
cisconnect any leads, then make a note of which jack socket
they came from,
+ Passwords that are used as pat of the computer operation
Should be obtained from the suspect if possible, as they may
be helpful, although they are not essential
Clckon What to Avoid to em more,
Search
Page 1 of 1
~ Selec atopic TT AYD Raat cup
Cit Netcong, Pak He
i Introduction to Investigations
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page I of 1
Royal Nail Group
Seizing Computer Evidence
Seat
Current Guidelines
Current guidelines recommend thats
+ Allcomponents ofa suspect PC are seized, and if you
disconne
Things Not to Do lose
they can
sl Tosummarise, i you decide tosezea compute, avait
should 4 inthe state you find it and never:
be helf
+ Tryto print off anything thats onthe screen
+ Suftchit of following normal dose dovin procedures - I
Clckon What! ‘ust disconnect it from the mains power
Suitchiton
You cen assure the owner thet these above actions will not
demage the computer The compute, once confiscated,
then treated inthe same way a any other seled propery, I
Clk Nextt continua, _B2¢k {05 of 5; Next
Prot
I
ES] nducion to nvestatos B bl q & I
Search
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
General Search Considerations _. Selecta topic : Royal Hail Group
General Search Considerations: Overview
There area numberof areas that need to be considered when
Conducting searches, such as:
* Searching to the extent required for the purpose ofthe search
+ Shoulda friend be allowed tobe present, if requested?
» The rules relating to carying outa personal boy search
+ Haw people should be treated should our searches reveal
nothing of an incriminating nature,
Tihs section looks atthe actions that should be taken in these
Circumstances,
Search Chek Netto cone, Bk of] ext
Pink
ka] Introduction to Investigations A dl q &
I
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page 1 of 1
Progress Check ~Slctatopic Yl al Grup
Progress Check
List the three actions required immediately after an item has been seized i ~
uring a search, + Did you gt that right?
I
The actions are:
+ Immediately an item i seized, it
must havea label attached tit
orbe placed in an exhibit bag,
Write your answer in the textbox. Then dick on Submit, + Temust be given the initials of
the Investigation Manager
to give ita numba, to put tina sealed bag and to sin the ext tag C4 mekig the seizure andthe
next sequential number,
« The lnvestigation Manager
finding the ftem should inital
the relevant entry on the
GS005d as soon as possible.
Search ine ext
fl Introduction to Investigations
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co... 11/02/2011
POL00105437
POL00105437
POL00105437
POL00105437
Royal Mail - e Conversions Page I of 1
Progress Check 7 Sdectatopie Ayal Mal Group
Progress Check
Desarbe briefly how property seized during a search should be kept. S
i
Did you get that right?
The seized property must be kept in
secure conditions at all times. It must
beretained in sealed exhibit bags,
and a control system for booking
Write your answer inthe text box. Then dick on Submit, exhibits in and out must be
mzintained, in order to ensure the
ina secure oto, cupboard ir oth tec,
Search Click etto conn, Back 04 of 2) Next
fil Introduction to Investigations
http://uxcont68.sabahosted.com/content2/cninv000000000007412/html_scorm_12/co.... 11/02/2011
POL00105437
POL00105437