Fictional story for information purposes. It does not constitute legal advice and does not replace actual assistance in a real case.
How the first 90 minutes of your defence are played
The knock on the door comes with no soundtrack. “Police. We have a search warrant.” 6:02 a.m. — a time that doesn’t care about sleeping children, freshly ground coffee or emails left in Drafts. Ana takes a short breath, opens the door and sees three things: the vest with markings, the folder with rounded corners, and a camera glowing red. She remembers a piece of advice she once heard: “when you don’t know what’s coming, put order into small steps.”
The first step: read the warrant as if it were a contract that directly concerns you. The exact address is written, the type of search (home search) and the categories of items targeted: “data storage media, accounting documents.” You don’t see “warehouse,” “registered office,” “storage unit in the basement.” These absences are not a consolation – they are limits. You mark them calmly, not by making a scene.
The second step: set the tempo. Ana calls her lawyer and, without philosophising, recites three cold facts: the case file number, the time, the name of the prosecutor mentioned. Then she sets out the three requests that make the difference between “surviving” and “being able to rebuild later”: (1) checks on devices are done by forensic copying, not “live” access; (2) the inventory is detailed (serials, models, photos, times); (3) any statement on the substance of the case is postponed until after the documents have been reviewed.
A search is not a duel. It is co-existence under pressure. The investigators do their job; you protect your rights. That’s how the small scenes appear that matter a lot: a USB stick labelled “backup” on the desk; the question “can we quickly open it?”; the professional answer “we will proceed with forensic imaging so as not to alter the metadata.” No raised voices, no sharp replies. Just procedural hygiene.
“A short statement, just to clarify why the server is at home.” The trap lies in the adjective. “Short” sounds harmless, but in the file every word has its own specific weight. Ana does not refuse, she simply sets the order of things: “I will give a statement at the station, in the presence of my lawyer.” Persistent, not defiant.
The personal laptop opens another chapter: private life. Photos of the child and notes for kindergarten are not “data without importance”; they are data unrelated to the case. The lawyer asks for this boundary to be recorded: during imaging, only the relevant folders are extracted, and the rest remain sealed. Practically, you reduce the useless “dump” that freezes your privacy and clutters the evidence with thousands of files that say nothing about the allegation.
The perimeter is the next frontier. A wardrobe in the shared hallway? “Connected to” in everyday language is not the same as “authorised” in procedural language. Its existence is recorded, it can be sealed, and any extension of the search must be requested formally. You don’t block the investigation; you keep it within its legal banks.
In real life, at 6:47 a.m. the children also wake up. One officer steps aside for a plush bear, another softens his voice without softening his role. Humanity doesn’t contradict firmness; it humanises it. And a search report that records times, people, items and observations will show, months later, that the pressure was administered, not poured through a funnel.
When the inventory reaches paper, exactness beats rhetoric: not “a laptop” but “Laptop X, Model Y, SN Z, photographed”; not “a stick” but “32GB USB stick, label ‘backup’, seal no. …”. These details don’t make the article thrilling, but they save hours of sterile discussion when, inevitably, the question arises “is this the same device?”
The cloud is a temptation in any modern search. You are logged in; everything is “one click away.” But an undisciplined click can open an account outside the scope of the warrant. You note the identities of the accounts; you don’t browse through them. Requests for cloud data have their own path. When you keep these fences in place, you also keep the evidence clean.
After two hours, the scene quiets down. On the table remain the search report, the seals, a list of items. In the days that follow comes the part that never makes the trailer: the application for partial return or replacement of the seizure. If the search seized critical tools for continuing your activity (NAS, work laptop), you explain the impact concretely and propose solutions: certified copies of the relevant files, limited access, replacement with forensic images. The keyword is “proportionality.”
Then comes the expert examination. Fiscal, IT forensic, sometimes both. The integrity of the evidentiary chain becomes the lighthouse: when the imaging was done, who handled it, on which workstation, what hash was generated, which reports were produced. These are not technical whims. They are anchors that keep toxic doubts at bay: “maybe it was altered,” “maybe it was deleted,” “maybe it was inserted later.”
The media have their own role in the background. Headlines about “networks,” about “in flagrante” situations that never existed, about “dozens of devices” that, in the file, are four. It is hard to shield yourself from such dramatic summaries. What protects you is the dull music of documents: the exact list, the exact times, requests made in time, refusals formulated in a civil manner, the chronology preserved.
When you get to questioning, you’re not looking for spectacular lines, but for a coherent narrative. “I knew this, I didn’t know that. This is how I worked. There I made a mistake. Here I corrected it. Here I delegated. Here I checked.” It’s not a show – it’s an outline. And that outline is convincing only if the first page of the file shows order.
Typical mistakes in early-morning searches are banal and costly: letting the team “take a quick look” at a device (“just two minutes” that change the metadata), agreeing to “clarify” complex facts on the spot in a “short statement,” confusing the desire to cooperate with an obligation to waive rights. The antidote is not conflict, but discipline: “I’m not refusing, I’m postponing until my lawyer arrives”; “forensic imaging, not live access”; “a detailed inventory, please.”
A telling episode: “the shared wardrobe.” Its existence is recorded, sealing is ordered, extension of the warrant is requested. Two days later, the authorisation arrives and the wardrobe is searched lawfully. You did not block the investigation; you protected its legitimacy. Or the “phantom stick” episode: later found among boxes, with no initial entry in the inventory. It is recorded as “found subsequently,” sealed separately, and explained in a memo. Without order, such episodes erode trust. With order, they become simple footnotes.
Frequently asked questions, put simply
- “Can I film?” — It depends on the context and any applicable instructions; what you can always request is that your observations be recorded in the search report.
- “What if I’m not at home?” — The procedure has alternative routes (trusted persons, representatives of the owners’ association); the focus stays on a rigorous inventory.
- “What do I do with passwords?” — Don’t improvise. Agree a protocol with your lawyer: imaging first, then controlled access; passwords are not handed out randomly.
- “Can they copy my children’s photos as well?” — Ask for a clear boundary: data unrelated to the case remain sealed; only what is relevant is accessed.
- “What if they ask me for a statement on the spot?” — Say politely: “I am not refusing, but I will give it at the station, in the presence of my lawyer.”
- “What if the press asks questions?” — Strategic silence is healthier than two sentences that will be misinterpreted for months on end.
Extended checklist
- Read the warrant (scope, limits, items targeted). Cover sensitive data when sharing it.
- Note the key times: arrival, start of the search, relevant moments, completion.
- Ask for a detailed inventory: names, serial numbers, models, photos of labels.
- Request forensic imaging, not live access; ask for hashes to be recorded where applicable.
- Draw a line around personal data unrelated to the case; request that they be sealed.
- Postpone statements on the substance of the case until you have reviewed the documents with your lawyer.
- For “connected” spaces, ask for sealing and separate authorisation; don’t allow informal extensions.
- After the search, prepare applications for return/replacement of seizure for essential items.
- Keep a simple log of who was there / when / what was taken; it will serve you at later hearings.
- Maintain a civil tone. The file will show the difference between firmness and useless opposition.
Behind the scenes, the technical work is laborious. A forensic image preserves the bit-by-bit structure of the drive. The hash (for example, SHA-256) ensures that the image used for searches is identical to the original. The expert writes log entries, uses clean workstations, preserves the chain of custody. When these things exist, discussions move, as they should, to the substance: what the files indicate, what the emails explain, what the transactions mean.
On a human level, a search is a blow to family routine. It is normal to be afraid, to tremble, to have tears in your eyes. What matters is that emotion does not replace decision-making. Instead of saying “I don’t understand anything,” say “please tell me what has been recorded so far.” Instead of “clarifying” everything on the spot, clarify your rights first. Instead of shouting, breathe and ask for your observations to be written down. Dignity does not lie in harsh replies; it lies in order under pressure.
After a few months, the file no longer resembles that morning. It is a map of documents. When you look back, you will see that the first 90 minutes decided what kind of map you have: one with clear paths or one with thick lines drawn all over. The first gives you real chances. The second exhausts you for nothing.
The 6:00 a.m. search is not where you “win.” It is where you avoid losing what you will need in order to fight fairly: the integrity of the evidence, the limits of the perimeter, a clean chronology, your right to remain silent until you understand, respect for private life. When you lay these bricks one on top of the other, you have a house you can live in, procedurally speaking, not a wall you keep crashing into.
A short epilogue: the morning when someone knocked on the door stays in the body. But something else remains in the file: that you read the warrant, called your lawyer, insisted on forensics, kept your tone measured, kept the cloud door closed until authorisation, logged times, filed applications in due time. That is the discreet difference between panic and position. The first passes. The second remains.
When she leaves the house, Ana takes her child to kindergarten with shorter steps than usual. On the way, she silently repeats the order of the morning like a breathing exercise: warrant, limits, inventory, imaging, observations, silence on the substance. The teacher asks if everything is alright. She doesn’t tell the story. She just says she will be late to the office. In her mind, however, the office is now a folder: applications, acknowledgements, registration numbers.
All of a sudden, she understands that defence is not a witty reply, but a list done properly and carried through to the end.
At noon, her lawyer sends her the draft application for partial return of seized items. The text is sober, without epithets: it describes concretely the economic impact of the seizure of devices, proposes the temporary return of some of them on condition that forensic copies are preserved, and offers a plan for controlled access to strictly relevant folders. Ana adds data, attaches invoices, screenshots of unfulfilled orders, a letter from a courier. It’s not drama—it’s accounting for a morning that put the brakes on a business flow.
In the evening, the accountant joins a video call and asks, in a low voice, what was seized. Together, they reconstruct the path of the documents: what is on the cloud, what on the NAS, what on the laptop, what in the physical archive. For each category, they decide what can be reproduced immediately and what must wait to be returned. They note tasks: to update internal policies on log retention, to structure access by roles more clearly, to reduce the mix between personal and business data on the same device.
Good defence also works towards the future: it minimises opportunities for confusion.
In the days that follow, the IT expert calculates the hashes of the images and the imaging conditions. It is a page full of numbers and a paragraph about the chain of custody. When Ana reads it, she doesn’t see “tech”; she sees calm: it means that, no matter how many discussions there will be on the merits, no one will endlessly debate whether “someone tampered with” the original. And that calm, in criminal files, is a kind of capital that you can only earn once: on the first day, when you insist on forensics before “let’s just take a quick look.”
One afternoon, she also receives a question from the press about “searches at a network.” She has already learned the lesson of strategic silence. She sends a short reply: “No comment. We will cooperate within the limits of the law.” Then she hangs up and continues her routine: an email to a supplier, an offer to a client, a request to schedule access to the case file. On the surface, nothing spectacular.
In reality, that determination to keep the thread of normal life is itself part of the defence: it shows who she is, not who others say she is.
When the first hearing comes, she does not look for courage in memorable lines. She looks for it in the chronology she wrote herself, without adjectives: what she knew, what she did, what she delegated, what she checked, where she erred and corrected. These words don’t make pretty pictures. But they build a backbone. And in the courtroom, that backbone is often the only thing that keeps you standing when others’ story about you is trying to bend you.
At the prosecutor’s registry, Ana files an application to inspect the case file and, where possible, to receive copies of the search report and the seizure order. She does not ask for “everything”; she asks for what she knows she needs for the next step. The clerk explains the formalities and office hours. She learns another rule: not all doors open immediately, but almost all of them open if you come back in the right order.
The first meeting with the prosecutor is not a confrontation; it is a clarification. The lawyer speaks in a tone that doesn’t stir up dust: “we are not contesting the search; we only ask to keep the essential business activity going; we will provide what is relevant, in certified copy, based on the forensic images.” The prosecutor asks about the flow of goods, the role of the server, access to accounts. When the questions are clear, the answers don’t become traps.
It becomes clear that “cooperation” is not the opposite of “rights,” but the civilised way in which rights sit at the same table with the investigation.
One evening, after the child falls asleep, Ana puts down on paper “what I learned from that morning.” She writes briefly: not to mix personal life and the business on the same device; to have real internal policies, not just dusty documents; to have verified backups and an access log; to know where my documents are; never to say “just a little” when it comes to the integrity of evidence. She leaves that text on the fridge. It won’t convince a judge, but it convinces her not to go through the same hard lesson again.
At the hearing on the application for return of seized items, the judge asks to see concrete impact: numbers, not metaphors. The lawyer shows unfulfilled orders, lost margin, fixed costs, ongoing contracts. In parallel, the prosecutor shows the risk of evidence being tampered with and explains why certain devices must remain under seizure.
The solution is balanced: temporary return of one laptop under strict conditions and certified copies for specified files; the NAS remains under seal until the forensic examination is completed. Neither side wins completely. What wins is the idea of balance.
A technical detail becomes, over time, a moral support: the report on the computer search. It shows times, hashes, serial numbers, software versions. For an outsider, it looks like a foreign language. For Ana, it means that her work will not be judged by guesswork but by something measurable. In a world where big words make headlines, these small numbers give her, paradoxically, courage.
After a few weeks, when questioning begins, Ana tells the same story she has written: without embellishments. She is not defending her perfection; she is defending her order: what she knew, what she checked, what she delegated, what she corrected, where she went wrong. You can hear in the room that she is not trying to shine. She is trying to be credible. And credibility, in a case file, is the sum of the things you did on the day someone knocked on your door.
One quiet morning, she receives an email from an old client: “I know you are going through a difficult time. When you come back, we’ll renew the contract. You always kept our paperwork in order.” It’s not evidence. But it is proof that the order in a case file is not separate from the order in life. When one falters, the other can serve as a handrail, at least until you get down the stairs safely.
On the last page of the notebook where she kept the chronology, Ana writes a sentence without emphasis: “The search was about objects; the defence is about how I arrange them, with a clear mind.” It is not a conclusion; it is a rule for everything that follows. And simple rules are the ones that pass the six-month test: they remain valid when fatigue and noise creep in.
On a Sunday, Ana reorganises her office. For the first time, she truly separates “family devices” from “work devices.” She moves photos to an external drive, creates two distinct accounts, installs a password manager and turns on two-factor authentication. It’s not paranoia; it’s hygiene. She understands that an orderly digital life is not just convenient; it’s defensible.
At the next meeting with her lawyer, they discuss scenarios: what happens if the expert finds real errors? What if the report finds indications of negligence? What if there are aspects unrelated to the case? The answers are not promises; they are plans: remediation, clarifications, delimitations. When you have plans, fear no longer leads— it follows.
In her phone calendar, she sets three recurring alarms: weekly backup, monthly export of activity logs, quarterly access audit. It sounds excessive for a small online shop. But the morning of the search taught her that small things, put in their place at the right time, can shorten months of discussion.
When she receives the first progress report from the expert, she reads it alongside her lawyer. Where she doesn’t understand, she asks. Where needed, she gives context. Where she has nothing to add, she remains silent. She learns the discipline of the three verbs of defence: explain, prove, delimit.
At the end of a long day, she allows herself a simple thought: the morning at 6:02 did not steal her life; it changed its rhythm. When she turns off the light, she knows that today’s order guarantees nothing for tomorrow, but it improves her odds. In law, that means more than it seems.
In a short letter to herself, Ana writes down three decisions for the near future: “1) I will map my data—where it is, who has access, what logs I keep. 2) I will separate devices, accounts and habits—professional from personal, with no shortcuts. 3) I will train my team to know the first ten things to do on a search day.” These are not slogans; they are steps.
The next day, she tapes to the inside of a cupboard a sheet with simple bullet points: read the warrant; fix the limits; detailed inventory; imaging before access; delimit personal data; observations in the report; postpone statements on the merits; well-reasoned applications for return; log of times; civil tone. It is perhaps the least glamorous object in her house. But it is the only one that, on a morning without music, can become the metronome of a dignified defence.
Beyond codes and statutes, defence is sometimes simply the way you keep your own rhythm when someone else is knocking at the door.