Attending phone forensics and the data selection process

There are things to do in the first few days after you hand over your phone. You are usually contacted separately about the forensics schedule, so prepare before then.

• Find out whether the phone was taken under a warrant or you handed it over voluntarily, and get a copy of the list of seized items or the voluntary submission form.
• Tell the investigator in charge clearly that you want to attend the forensics, and if possible put it in a text.
• If you are given a form asking whether you will attend, mark that you wish to attend. If you sign that you will not attend, you lose the chance to give your views during selection.
• Make a note of what data is on the phone. Writing down where unrelated photos and work files are makes it easier to give your views during selection.
• If the device is essential for work, also ask about the procedure for getting it back.

The rule is to select only the information related to the allegation, where the phone is, and print or copy just that. If that is impossible or would make it extremely difficult to achieve the purpose, investigators can copy everything and take the copy, or seal the original device in the presence of the person whose phone is seized and take it away (Criminal Procedure Act (형사소송법) Articles 106(3) and 219; Investigation Rules (수사준칙) Article 41).

Once taken, the process runs in this order: copying (imaging), searching, and selecting information related to the allegation. When selection is finished, investigators must hand over a list of the electronic data seized, and data not on the list must be deleted or destroyed, or returned, with a confirmation given to you. The right of the person whose items were seized, and their lawyer, to be present is protected throughout (Investigation Rules Article 42).

The Supreme Court held that even for a phone handed over voluntarily, if the person's intention is not clear, only information related to the allegation that prompted the submission, and with at least minimal value in proving it, may be seized. Where a third party such as the victim hands over the suspect's phone, the scope must be read even more narrowly, and procedural rights such as the suspect's right to be present and to receive a list must be respected (Supreme Court en banc Decision 2016도348, November 18, 2021). When you submit something voluntarily (임의제출), make sure the form clearly states what scope of data you are handing over.

The Supreme Court held that if investigators take a device and copy, search and print from it without giving a chance to attend or taking steps to prevent unrelated information from being copied, it is in principle unlawful (Supreme Court en banc Order 2011모1839, July 16, 2015). When you attend, look at the following.

• Whether only data matching the allegation and period in the warrant or voluntary submission form is selected
• What search terms and periods are used to look for data
• Whether photos, conversations or work files unrelated to the case are kept off the list
• Whether your views on relevance are written into the record (Investigation Rules Article 42(5))
• Whether you receive the list and the confirmation of deletion or return after selection

If you are asked to unlock the phone or give your password, talk to your lawyer before answering. What you open can change the scope of selection.

If there is no need to keep holding it, you can get it back, and for a device you need to keep using, you can ask for provisional return (가환부) (Criminal Procedure Act Article 218-2). If you disagree with a decision on seizure or return, you can ask the court to cancel or change it (Article 417).

Right after the seizure, we apply to attend the forensics, go into the selection process with you, raise objections to data unrelated to the allegation, and make sure those objections are recorded. For the suspect questioning that follows, we prepare likely questions based on the selected data. If you have handed over your phone, contact us through the chat on this page before the forensics date is set.