Adaptive Investigation of Regulations Governing Search and Confiscation of Electronic Evidence

Changing the nature and method of committing traditional crimes to cyber crimes such as cyber fraud raises this main question in the criminal proceedings law that what changes of search and confiscation will this nature of change bring about in the method of obtaining evidence through issueing search and confiscation order of the system or data in the physical domain and what rules and regulations will be needed, as well? This article has attempted to answer this question in a descriptive-analytical method and using data collection through note-taking and library research. Computer system as the place of searching for electronic evidence has considerable differences from a house as a search place of physical evidence. Rules governing the attainment of electronic evidence in Iran and in America, requires the search order having two issues: firstly, confiscation of the computer system in the place where this system is and secondly search order for the files residing in the system. In regards to the confiscation of the system or data, the US Criminal Law emphasizes on the role of the computer hardware and distinguishes between the system which are the subject of crime themselves and the systems that are only the place of maintaining the incriminating evidence, but Iran’s Law emphasizes on the confiscation of data unless in certain exceptional cases such as time-consuming search or large volume of data. If for any reasons, the system is confiscated, regarding the time it takes to search in the computer system which is in police stations, it is not necessary for police agents to comply with the physical evidence search rules, for example; to do the search order only in daytime, but they can do the search in the systems or data at any time of day.