Developing a ‘router examination at scene’ standard operating procedure for crime scene investigators in the United Kingdom

As the majority of dwellings now maintain some form of Internet connectivity, the examination of routers at crime scenes is an increasing requirement. Due to cost and resourcing constraints, police forces are looking to transfer responsibility for carrying out this task to front line crime scene investigators, despite such staff typically lacking specialist training for this type of examination. Such strategies are potentially high-risk, as the mishandling of home routers can result in the oversight or destruction of potentially evidential information denoting home network usage, configuration and connected devices. This information can support scene examiners with their searching practices, ensuring all connected devices within the vicinity of a scene are accounted for or seized, whilst also supporting further technical investigations. This work documents the forensic examination of Sky, BT, Virgin, EE and TalkTalk routers and analysis of relevant evidence content including records of attached and currently connected devices, and, network configuration settings. A standard operating procedures has been developed and offered, to support crime scene investigation staff carry out router investigations.