🚨 1. Initial report → opening investigation

Time: Same day to a few days

• Report received (police, INCIBE 017, school, or victim disclosure)
• Risk is assessed immediately
• Devices may be seized quickly if there is urgency

👉 In urgent child protection cases, action can be within hours

---

💻 2. Forensic extraction of devices

Time: 2 weeks to 3+ months (sometimes longer)*

This is often the slowest stage.

It depends on:

• number of devices
• encryption level
• data volume
• backlog in forensic labs

👉 Complex phones or multiple devices = longer delays

---

🧠 3. Analysis + case building

Time: 1–6 months (can overlap with forensics)

Investigators:

• link accounts and suspects
• analyse chat patterns and metadata
• identify victims or networks
• check cross-border connections

👉 If it’s a larger network, this stage can extend significantly

---

⚖️ 4. Judicial phase (charges or formal suspect status)

Time: weeks to several months after evidence is ready

• Judge reviews forensic report
• Decides if charges proceed
• Authorises arrests or continued investigation

👉 Spain uses a judge-led system, so timing depends on court workload too

---

🚔 5. Arrests or indictments (if applicable)

Time: any point after sufficient evidence is confirmed

• Can happen early (if risk is high)
• Or later (after full network mapping)

---

🧾 6. Court process

Time: 6 months to several years

Once in the judicial system:

• hearings
• expert testimony
• defence review
• sentencing

👉 Complex or international cases take longer

---

🧠 So what’s the overall timeline?

• Simple single-device case: ~3–9 months
• Moderate case: ~6–18 months
• Network / international case: 1–3+ years

---

⚠️ Important reality

• Encrypted apps do NOT make cases “fast or slow” on their own
• The delay is mostly:
  • forensic workload
  • legal authorisation steps
  • complexity of digital evidence chains
  • international cooperation if needed

---

🧭 Key principle in Spain

Speed is balanced with legal certainty and evidence integrity.

They prioritise:

• correct evidence handling
• protection of minors
• court-ready proof (not rushed conclusions)

---