Part IV — Operational Standards and Legal Admissibility

NON-TECHNICAL HRD

No forensic tools available

Physical documentation using a second device camera - photograph the screen showing the evidence, URL bar, and system clock. Record device serial numbers, IMEI, and MAC address manually. Complete paper-based Chain of Custody form.

All HRDs can do this immediately. Provides legally useful documentation even without technical tools.

DIGITAL SAFETY OFFICER

Basic forensic capability

Screenshots with metadata preserved. Email header extraction. Hash computation using CyberChef. Encrypted backup using iMazing (iOS) or ADB (Android). Completion of digital Chain of Custody log.

Appropriate for incidents only require triage. Produces admissible evidence if SHA-256 hash is computed immediately and chain of custody is maintained.

TECHNICAL RESPONDER / HUB

Full forensic capability

Bit-for-bit forensic disk imaging using FTK Imager or Autopsy. RAM capture using Volatility. Write-blocked acquisition. Full Chain of Custody documentation. Hash verification before and after imaging.

Required for incidents that require deep investigation and any case intended for court. Contact Tatua Digital Resilience Centre or KE-CIRT for hub-level response.

Evidence ID

Unique case reference number

HELP-2026-NBI-001 (format: ORG-YEAR-CITY-SEQ)

Evidence Type

Nature of the digital artefact

Mobile phone, laptop hard drive, email thread, screenshot, USB drive

Hardware Identifiers

Device-specific unique identifiers

Serial number, IMEI (mobile), MAC address, model number

SHA-256 Hash

Cryptographic fingerprint at time of collection

64-character hex string generated using CyberChef or sha256sum immediately upon collection

Collection Date/Time

Exact timestamp with timezone

2026-04-15 14:32 UTC+3 (EAT) - always specify timezone

Collection Method

How the evidence was acquired

Forensic bit-for-bit image using FTK Imager v4.7 / Screenshot with metadata /

Collector Name & Title

Identity of person who collected evidence

Full name and organisational role - not a pseudonym

Collector Signature

Physical or digital signature

Required for Section 106B compliance

Storage Location

Where evidence is stored after collection

Encrypted external drive SN: [XXXX], locked in Room 3B, Organisation HQ

Custodian History

All persons who subsequently handled evidence

Name, title, date/time of receipt, date/time of transfer, reason for transfer, signature

Transfer Signatures

Signed handover for every custody change

Both 'Released By' and 'Received By' must sign at every transfer

Access Log

Record of every access to stored evidence

Date, purpose, person accessing, time returned to storage

Evidence admissibility under s.106B

Evidence collected without hash verification, proper chain of custody, or from a malfunctioning device may be ruled inadmissible

Always compute SHA-256 hash at point of collection. Maintain unbroken Chain of Custody from collection to court. Document device operational status at time of collection.

72-hour ODPC notification deadline

Missing the notification window creates regulatory liability even if the underlying breach was not the organisation's fault

Designate a named person responsible for triggering the ODPC notification clock and maintaining the notification template in the Jump Kit.

Arbitrary device seizure

Authorities may seize devices under the CMCA without adequate procedural safeguards, destroying evidence and exposing sensitive data

Maintain current off-device encrypted backups. Know your legal rights under the CMCA. Have legal counsel's number memorised. Do not unlock devices under duress.

 CMCA 2018

Provisions of the CMCA intended to prosecute attackers have been used against security researchers and defenders themselves

Document all forensic activities with timestamps and purpose statements. Operate within a formal organisational mandate. Consult legal counsel before any active offensive investigation.

Cross-border jurisdiction

Spyware operators and hosting infrastructure are typically based outside Kenya - legal remedies are limited by jurisdiction

Coordinate with international partners (Citizen Lab, Access Now, Amnesty Tech) who have established legal frameworks for cross-border digital rights cases.

Data protection liability

HROs holding victim, witness, or staff PII without adequate security measures may face ODPC penalties following a breach

Implement data minimisation - collect only what is necessary. Conduct a data audit. Establish formal data retention and deletion schedules.

Informed Consent

Obtain explicit, informed consent before collecting, storing, or sharing any evidence related to an individual. Explain in plain language what will be collected, who will see it, and what risks sharing carries.

Re-obtain consent before every new disclosure - sharing with a colleague, a forensic lab, or a regulator each require separate consent. Consent given once does not cover all future actions.

Right to Withdraw

The defender has the absolute right to stop the forensic process at any time, for any reason, without justification.

Never pressure or guilt a defender into continuing. If they withdraw consent, stop immediately and discuss what happens to data already collected.

Non-Shaming Principle

Never imply that the victim is at fault. Sophisticated targeted attacks compromise experts. The investigation focuses on attacker infrastructure, not on what the victim did wrong.

Open every engagement with an explicit statement that the attack was not their fault. Redirect all 'how did this happen' questions toward the attacker's methods, not the victim's behaviour.

Minimise Re-Traumatisation

Avoid asking the same questions repeatedly. Avoid requiring the victim to relive distressing events unnecessarily. Work through a trusted intermediary if the victim is too distressed to engage directly.

Collect information once, document it thoroughly, and share internally rather than asking the victim to repeat their account to multiple people.

Data Privacy in Triage

Do not upload files from a targeted attack investigation to public analysis platforms (VirusTotal, Any.Run) without explicit consent and awareness of the risks - the attacker may be monitoring these platforms for evidence their payload has been detected.

Use hash-only lookups wherever possible. If a file must be submitted, strip all metadata first and use a VPN from an isolated analysis environment.

Confidentiality of Investigation

Never discuss a live investigation through channels that may be monitored by the adversary. Use out-of-band encrypted channels (Signal) on separate devices for all coordination.

Compartmentalise information - share only what each team member needs to perform their specific role.

Granting Agency

Give the defender as much control as possible over the investigation. Let them enter their own passwords. Let them approve each step before it is taken.

This is not just ethical - it produces better outcomes. A defender who understands and controls the process is more likely to provide accurate, complete information.