How to judge when it’s safe to move forward with forensics (Spain)
Think in three phases: preserve → stabilise → analyse.
Forensics should never be rushed just because someone else is panicking.
PHASE 1 — PRESERVATION (most critical)
You are in this phase now if any of the following are true:
- The other person is:
- Panicking
- Asking you to “fix,” “reset,” or “move on”
- Denying, minimising, or changing their story
- Devices are:
- Recently wiped
- Locked
- Potentially accessed remotely
- There is:
- An existing or potential denuncia
- A history of control, deletion, or surveillance
What this means
Do NOT start forensic work yet.
Your priority is:
- ❌ No powering on/off repeatedly
- ❌ No password attempts
- ❌ No “trying things”
- ❌ No well‑meaning IT help from friends or shops
Preservation protects you legally.
PHASE 2 — STABILISATION (this is when it becomes safe)
It becomes safe to proceed only when these conditions are met:
✅ Legal clarity
At least one of the following:
- A denuncia has been filed
- A lawyer has advised you to proceed
- You have documented intent to preserve evidence (even by email to yourself)
This protects you from accusations of:
- Evidence tampering
- Unauthorised access
- Data manipulation
✅ Emotional pressure has dropped
This matters more than people realise.
If the other person is:
- Urging speed
- Threatening consequences
- Trying to control timing
⛔ That is a reason to wait, not proceed.
Forensics done under pressure often:
- Miss evidence
- Get challenged in court
- Weaken your position
✅ Chain of custody can be explained
You should be able to say (simply):
“The device was preserved, not altered, and handed to a professional.”
That sentence alone carries weight.
PHASE 3 — FORENSIC ANALYSIS (safe window)
✔️ Computer forensics
It is generally safe to proceed when:
- The computer has been powered off and untouched
- You are using a neutral, professional forensic service
- The purpose is documentation, not confrontation
A proper forensic examiner:
- Works from a forensic image
- Does not overwrite data
- Can testify if needed
✔️ Locked phone forensics
Phones are more sensitive.
It is safe to proceed when:
- You own the phone or account
- You are not guessing passwords
- You are not bypassing security yourself
- A professional confirms lawful access
If the phone is locked:
- Waiting does not destroy evidence
- Rushing often does
Important truth
Panic on the other side usually means:
- Evidence existed
- Control is being lost
- They fear what timing reveals
Their panic is not your deadline.
What courts care about
Courts care far more about:
- Evidence integrity
- Calm, documented steps
- Professional handling
They care very little about:
- Speed
- Emotional explanations
- “I just wanted to check”
Simple decision rule
Move forward with forensics only if you can answer YES to all three:
- Is the device preserved and untouched?
- Can I explain my timing calmly and logically?
- Am I acting from clarity, not pressure?
If any answer is no → wait.
Waiting protects you.
