🧾 1. Forensic report is produced

• Specialist cybercrime officers (Policía Nacional or Guardia Civil) analyse devices in a lab
• They create a forensic report (informe pericial)
• This includes:
  • recovered files
  • chat logs
  • metadata (dates, devices, accounts)
  • links to other users or platforms

👉 This report becomes formal legal evidence

---

👮 2. Case assessment by investigators

Once the report is ready:

• Officers assess severity of findings
• They determine:
  • type of offence (possession, distribution, grooming, etc.)
  • number of potential victims
  • whether more suspects are involved
  • whether it connects to wider networks

👉 At this point, cases may be split or expanded into larger investigations.

---

⚖️ 3. Judicial involvement begins

If criminal evidence is found:

• The case is sent to a judge (Juzgado de Instrucción)
• The judge authorises next legal steps:
  • charges
  • continued surveillance
  • additional searches or seizures
  • arrests if needed

👉 Spain uses a judge-led investigative system, not police-only prosecution.

---

🚨 4. Arrests or formal suspect status (if applicable)

Depending on evidence strength:

• Suspect may be arrested or formally named in proceedings
• Or placed under investigation (“investigado”)
• Devices and accounts may remain seized

👉 Not all cases involve immediate arrest—some are built over time.

---

🌐 5. Expanded investigation (if networks are suspected)

If links are found:

• Additional devices/accounts are traced
• Other suspects may be identified
• Europol/Interpol cooperation may be activated
• Digital platforms may be legally required to provide data

👉 This is how wider networks are mapped through evidence chains

---

🧠 6. Protection measures for minors (if involved)

If a child is identified as a victim:

• Immediate safeguarding steps are taken
• Social services are activated
• Psychological support is offered
• Communication with the suspect is stopped

👉 The priority is removal from risk and trauma protection

---

⚖️ 7. Court process

Once investigation phase is complete:

• Evidence is presented in court
• Defence and prosecution review forensic findings
• Judge decides:
  • sentencing
  • penalties
  • protective orders
  • rehabilitation or monitoring measures

---

🧭 Key principle in Spain

The forensic report is the foundation of the entire case.

Everything that follows is built from:

• digital evidence
• legal authorisation
• judicial oversight

---

🧠 Important grounding point

• Police do not rely on suspicion alone
• All conclusions come from verified forensic evidence
• Investigations can take months or years depending on complexity

---