Criminal procedure

What Investigators May Take—and What the Defence Should Check

Search and seizure are often spoken of as one event, but they answer different questions. A search authorises investigators to look in a defined place or source for specified material. Seizure is the taking or preservation of an object, document or data said to be relevant. A lawful search does not make every item found automatically seizable.

The person present should never obstruct officers physically. The useful response is to obtain the authority, call counsel, observe what happens and ensure disagreements are recorded through the procedure available.

Identify the legal basis and scope

Under Georgian criminal procedure, an ordinary search generally rests on a court ruling based on the required grounds. Urgent action may follow a different route and requires careful review of the written decision and later judicial control. The defence should obtain every ruling, decree, record and attachment rather than relying on the officer’s summary.

Read the named address, person, vehicle, device, account, object, alleged offence and date range. A warrant for company accounting records does not necessarily explain a search of an employee’s private cloud account. Scope is tested against the words of the authority and the facts used to obtain it.

Make the inventory usable

The search record should state the start and finish, participants, rooms or containers examined, techniques used and each item taken. Generic descriptions such as “documents” or “electronic devices” make later identification difficult. Devices should have model and serial information; storage media should be labelled; sealed packages should carry unique numbers.

Where permitted, ask for a copy of the record and inventory before officers leave. Note requested corrections, objections, damage and any item that was taken but omitted. Record whether originals or copies were removed.

Device seizure is not unlimited data access

A phone can hold years of personal, privileged and third-party information. Taking the physical device and examining all its contents are analytically distinct. The legal basis, relevant accounts, period, search method and handling of unrelated or protected material should be assessed.

Remote data raises further questions about provider records, credentials and jurisdiction. A screenshot of a chat is not the same as a forensic extraction. The acquisition method, time settings, deleted material, hashing and chain of custody may affect reliability.

Follow the item after it leaves

An exhibit should be traceable from discovery through packaging, storage, examination and presentation. Who opened it? Was the seal intact? Was a forensic copy made before analysis? Did testing alter or consume the sample? These are practical questions, not technical decoration.

Anyone assessing search-and-seizure procedure in Georgia should preserve evidence that could disappear from the searched location: camera recordings, access logs, photographs of the pre-search state and proof that an item belonged to another person. Witness notes should be written independently and promptly.

Ask what happens when retention is no longer necessary

Businesses and individuals may need originals or devices to work, study or access essential records. Georgian procedure provides routes concerning the return of property in appropriate circumstances. A request should identify the item, ownership, operational need, available forensic copy and why continued retention is unnecessary or disproportionate.

The legality of a search cannot be judged from the fact that something incriminating was found. Review begins earlier: authority, grounds, scope, conduct, inventory and integrity. That record determines whether the evidence can be tested and whether unrelated property can be protected.