Hardware, and where appropriate software, are to be seized from the accused as quickly as is lawfully possible, and evidence from the aggrieved party should be adequately secured
- followed by rapid evaluation by specially-trained police officers (highly-skilled staff) or external specialists (experts)
- verification and ascertainment of the time of the offence (do system time and real time agree?) and of the person(s) entitled and able to have access
- reconstruction of any deleted datasets
- establishment/reconstruction of Internet use paths
- where appropriate presentation of the underlying IT structure with non-standard case constellations
- where possible parallel to technical securing of evidence also questioning of witnesses and aggrieved parties to compare the information obtained
- storage of evidence (including the computer in case any subsequent investigations become necessary), either as an original or by mirroring hard-disks, CDs and DVDs in generally-readable formats pp. until the main hearing so that they can be submitted there without any problems; relevant data backups also in paper form where necessary
- comprehensible explanation of the technical terms for all involved in the proceedings with questioning of the (technical) investigation officer as an expert witness
- correct legal attribution of the offence/subsumption under the right element of the criminal offence
- Distinction between those involved and those not involved (important for warnings!)
- Attribution of use of the computer to a person or to several persons (particularly problematic when related to instances occurring abroad)
- Completeness of the datasets, where appropriate reconstruction of deleted datasets
- Sufficiently fast, comprehensive involvement of the providers (do they quickly comply with their obligation to cooperate?)
- Once the computer has been evaluated, the comprehensive report of the expert must as a rule be presented in the main hearing in its entirety because of the principle of oral hearings -> considerable time taken up
- Accusation relating to possession of child pornography: A large number of files have to be presented in the main hearing for inspection -> considerable time taken up
- IT specialists within the authority are frequently overtaxed; external experts are not consulted, or not until difficulties are discovered, which may however then mean that important data have not been recognised at the outset because of an incorrect assessment and are lost or wrongly evaluated (if for instance the verification of the existence of child pornographic data is unsuccessful because only standard programs are used for scanning, but the files are well hidden).
- With offences related to incidents occurring abroad: long duration of execution of international search orders for foreign banks in some cases