1. Core Stages in the Journey

How Digital Evidence Moves Through an Investigation

2. Communication Processes

Varying Communication across Europe

Communication is part of the process

One of the clearest findings from Clarus is that communication is central to the handling of digital evidence. It is not an extra layer added on afterwards. It is part of the process at every stage.

Formal communication

Some communication is formal. This includes:

• official requests for analysis
• written reports
• evidence forms
• entries in secure systems

These forms of communication are valued because they are traceable, standardised, and can be reviewed later. Formal communication is especially important when precision is required, when legal accountability is involved, or when findings need to be preserved for later challenge or scrutiny.

Across the partner countries, the general process often flows from the investigator, who outlines:

• the case context
• the device or evidence in question
• the legal basis for seizure or search
• the questions that need to be answered

The analyst then carries out the work and reports back in a formal format.

Informal communication

But formal communication does not tell the whole story. Clarus also found that informal communication is a necessary and routine part of investigative and forensic work.

Informal communication includes:

• phone calls
• quick conversations
• face-to-face clarification
• messages between colleagues
• preparatory discussions before official documents are submitted

It often helps practitioners solve problems, clarify uncertainty, agree on how to frame a request, or explain what a result can and cannot mean.

In this sense, informal communication can improve coordination and reduce mistakes. It can also make the system more flexible and more realistic.

Move to the next page by clicking the arrow on the top right to move to the next page in this section.

3. Preparatory Information

“Preparatory communication”

A useful concept stemming from the Clarus research is this idea of “preparatory communication”. This is the informal discussion that takes place before a formal process is completed.

For example, an investigator might contact an analyst to ask what can realistically be requested from a device, what timeframe makes sense, or which questions would be too broad.

Analysts may also discuss results with one another so they can agree how best to present findings clearly and accurately in a formal report.

In some settings this is more institutionalised than in others, but across the research it appears as an important way of making the formal process workable.

Familiarity and informal networks

Clarus also found that familiarity matters. Practitioners often turn to people they know and trust when they need quick advice or clarification. This may be because they:

• have worked together before
• are physically close by
• know that someone has useful expertise

These informal networks can be helpful, but they can also create shadow routes of communication alongside the formal workflow.

That is one reason the recommendations from the Clarus project to practitioners is around retaining the benefits of informal communication while improving traceability and documentation.

Communication across borders

Cross-border communication adds another layer. Digital crime and digital evidence often cross national boundaries, which means practitioners may need to communicate with other jurisdictions, service providers, and agencies using different procedures and languages.

Here, the risks include:

• translation problems
• inconsistent terminology
• delays caused by different systems and expectations

Clarus highlights these issues not to suggest that communication is failing internationally, but to show that it is a working part of the system that needs support, structure, and shared understanding.

Move to the next page by clicking the arrow on the top right to move to the next page in this section.

4. How Practice Differs Across Europe

Differences Across Countries

Different systems, similar stages

One of the strengths of Clarus is that it looked across several European partner countries rather than treating one national system as normal for everyone. This matters because the handling of digital evidence is shaped by:

• local structures

• legal systems

• resources

• role boundaries

Across the partner countries, the broad stages of the process are recognisable, but the details vary.

In some settings, digital forensic specialists are more likely to be closely involved at particular stages. In others, investigators may take on more responsibility for analysis after a forensic image has been created.

The following can all differ between systems:

• the presence or absence of certain roles

• the way requests are made

• the degree of formal corroboration

• the availability of infrastructure

Clarus does not present these differences as a simple good or bad ranking. Instead, it shows that the journey of digital evidence is shaped by the system it moves through.

Why do these differences matter?

This is also important for public understanding. It reminds us that there is no single universal routine that applies in exactly the same way everywhere.

The broad principles may be shared, but practices can vary across jurisdictions and organisations. That is one reason why clear processes, shared language, and well-managed information flow are so important. They help reduce confusion where systems differ.

Do all cases follow the same process?

So far in this module, we have looked at the journey of digital evidence as a series of stages, from the crime scene through to analysis and use in an investigation. This can make the process seem quite structured and predictable.

In practice, the process is not always the same.

One of the key findings from the Clarus research is that how digital evidence is handled can vary depending on:

• the type of case

• the context

• the resources available

The urgency of the case

For example, in a high-priority or time-sensitive case, decisions may need to be made more quickly. This can affect how evidence is handled at the scene, how quickly it is passed to specialists, and how much time is available for detailed analysis.

The type of crime

Different types of crime can also shape the process.

A case involving online fraud may focus more on digital traces such as communications, accounts, and transaction records.

A violent crime may involve a wider mix of physical and digital evidence, where devices are only one part of the investigation.

Who carries out the work?

There can also be differences in who carries out certain tasks.

In some situations, digital forensic practitioners may be closely involved in the early stages of a case. In others, frontline officers or investigators may carry out initial handling or decision-making before specialists become involved.

Differences between organisations and countries

Clarus also highlights that systems differ across organisations and countries. This means that while the overall stages may be similar, the detail of how those stages are carried out can change.

The important point is that there is no single fixed way that digital evidence moves through a case. The process is shaped by the situation.

Knoweledge Check:

5. Summary of Module B