Cybercrime Strategy of Mauritius 2017 The Cybercrime Unit also has a role in the crime prevention process and should engage, with others, in campaigns to protect the public from cybercrime. Businesses are also affected, as victims, and also as holders of data that may be valuable evidence in investigations. Lawful access to such data is crucial in investigations, and the CCU will make it a priority to engage with the business community to share information about threats and also to ensure the smooth transmission of lawfully required data. In addition to the specialist skills needed by the Cybercrime Unit and Police IT Unit, at the most basic level, all Police officers need to know how to take reports and gather and assess digital evidence, leaving specialist units to focus on more complex cybercrimes. Recruiting and retaining people with the appropriate skills is an essential component of ensuring our agencies are ready to deal with the cybercrime challenge. This may need a different approach, utilising the expertise of non-police officers to assist in the most technical cases. 7.2.2 Forensic Examination of Digital Evidence Forensic examination of digital evidence is a scientific process as with all other forensic examinations such as those of blood, DNA and fingerprints. As such, it is a process that stands independently of criminal investigations. The function is provided by the Police IT unit, for the Mauritius Police Force. The current practice, whereby the Police IT Unit, is also on many occasions involved in the criminal investigation process, will cease, once the Cybercrime Unit has acquired the skills identified in the previous paragraph. The MPF will consider applying for accreditation under ISO 17025, which will give the assurance of independence and quality control of its procedures. It is important that all agencies conducting digital forensics examinations in Mauritius are compliant with international standards. When dealing with digital evidence, general forensic and procedural principles should be applied. Actions taken to secure and collect digital evidence should not affect the integrity of that evidence. Persons conducting an examination of digital evidence should be trained for that purpose. Activity relating to the seizure, examination, storage, or transfer of digital evidence should be documented, preserved and be made available for review. The examiner should be aware of the need to conduct an accurate and impartial examination of the digital evidence. Digital evidence is fragile and can be altered, damaged, or destroyed by improper handling or examination. Examination is best conducted on a copy of the original evidence. The original evidence should be acquired in a manner that protects and preserves the integrity of the evidence. The purpose of the examination process is to extract and analyse digital evidence. Extraction refers to the recovery of data from its media. Analysis refers to the interpretation of the recovered data and putting it in a logical and useful format. Actions and observations should be documented throughout the forensic processing of evidence. Agencies likely to handle digital evidence should identify appropriate external resources for the processing of digital evidence before they are needed. These resources should be readily available for situations that are beyond the technical expertise or resources of the department. Agencies should also develop policies and procedures to ensure compliance with local laws. The basic steps to conduct a computer forensic 13 | P a g e