We introduced the the Guidelines for Patent Infringement Forensics by Zhejiang Intellectual Property Protection Center. The below article is the forensics methods and procedure in the Guidelines.

Forensics methods

The party shall adopt different forensics methods according to different types of evidence.

The Civil Procedure Law of the People’s Republic of China provides for eight types of legal evidence, namely: statements of the parties, documentary evidence, physical evidence, audio-visual materials, electronic data, witness testimony, expert opinions, and investigation transcripts. Among them, only the relevant documentary evidence, physical evidence, audio-visual materials and electronic data concerning the content of patent infringement need to be adduced by the parties.

Documentary evidence refers to the evidence that proves the truth of the case by the content or ideas recorded in words, symbols, graphics, etc. In patent infringement dispute cases, common documentary evidence includes contracts, documents and bills. 

Physical evidence refers to the evidence that proves the facts of the case by its existence of shape, quality, specification, characteristics, etc. In patent infringement dispute cases, the most important physical evidence is the patent infringing products. 

Both the documentary and physical evidence shall be submitted in original. If it is difficult to obtain the original versions, copies, photographs, copies, excerpts are also allowed for submission.

In patent infringement disputes, audio-visual materials and electronic data are important types of evidence. 

Audio-visual information and electronic data refers to the information stored in audio, video, electronic computer or other high-tech equipment to show the truth of the case. Audiovisual information commonly includes audio tapes, video tapes, film, etc. 

Electronic data is more diverse, including web links, emails, electronic data interchange, video and audio, online chat records, blogs, WeChat, cell phone text messages, electronic signatures, etc.

For this type of evidence, the party can use a variety of forensics equipment, including but not limited to computer, mobile, audio recorders, digital cameras, video cameras and other electronic devices for forensics purpose. The party should pay attention to the forensics procedure and follow the normative and correct process.

Correct forensics procedure

Before the forensics, the computer and other electronic devices should go through a clean inspection by the party, and generate a clean inspection report. The clean inspection report should provide computer inspection details and inspection conclusions.

Regarding the forensics on laptop or computer, the cleanliness check of laptop or computer should include: operating system information, computer information, basic network configuration information, hosts file configuration information, dial-up and virtual private network configuration information, LAN proxy configuration information, route tracking records, shared folder information, installed software list and its cache check result, operating system cache check result, browser cache check result, cookies check result, system environment variables, and system environment variables, cookies check results, system environment variables, system temporary directory, user directory, download directory, operating system platform, operating system kernel, computer information, and network configuration.

Regarding the forensics on mobile device, the cleanliness check should include mobile device information (including phone model and Root status, etc.), mobile network information, wireless network information, and the list of installed software (including software name, software version, package name, application signature, installation path, installation time, update time, and installation source, etc.), identification Number (IMEI), system version and kernel version information.

Static webpage forensics should record the following: (1) login time and IP address of the system; (2) the time and conclusion of the cleanliness inspection of the forensics server; (3) the webpage address and time during forensics; (4) static webpage content.

Computer video recording should record the following content: (1) login time and IP address of the system; (2) the time and conclusion of the cleanliness inspection of the forensics server; (3) the start time and end time of video recording; (4) the acquisition of video files.

E-mail forensics should record the following contents: (1) the time and IP address of logging into the system; (2) the time and conclusion of the cleanliness inspection of the forensics server; (3) the sender, recipient name and address of the e-mail; (4) the generation time and receipt time of the e-mail; (5) the content of the e-mail.

Call recording forensics should ensure clear recordings, data integrity, timeliness and anti-tampering. Call recording forensics should record the following contents: (1) calling party number; (2) called party number; (3) call start time; call called party time, called party answer time; call end time; (4) generated call recording file; and (5) the time of the cleanliness check and the conclusion of the check.

On-site recording forensics should call the microphone of the cell phone’s native system to collect recordings to ensure clear recordings, data integrity, timeliness and anti-tampering. On-site recording forensics should record the following contents: (1) start and end recording time information; (2) start and end recording location information; (3) the files obtained from recording; (4) the time of cleaning inspection and inspection conclusion.

Photo forensics should call the phone’s native system of camera capture images to ensure that the pictures are not tampered with, clear and recognizable. Photo forensics should record the following content: (1) photo time; (2) photo location information; (3) photo documentation; (4) the time of the cleanliness inspection and inspection conclusions.

Cell phone video forensics should call the phone’s native system of camera capture video, cell phone video should record the following: (1) start and end video time information. (2) the beginning and end of the video location information; (3) the recorded files; (4) the time of the cleanliness check and the conclusion of the check.

Cell phone screen recording forensics should call the phone’s native system screen recording to obtain video and screenshots, cell phone screen recording forensics should record the following: (1) the start screen recording time and end screen recording time; (2) the start and end of the recording reference location information; (3) if the interception screen page, record the “screenshot” operation time and (4) the video file of the screen recording and the screen recording file. (5) the time of the cleanliness check and the conclusion of the check.

Cell phone SMS forensics should call the SMS function of the cell phone’s native system to send and receive SMS messages, and cell phone SMS forensics should record the following contents: (1) the name and cell phone number of the sender and recipient; (2) the time of sending and receiving; (3) the complete content of mobile phone SMS messages; (4) the time of the cleanliness check and the conclusion of the check.

WeChat chat records forensics should record the following: (1) the identity of the two parties involved in the chat records, you can find the other user in the address book and click to view personal information, show the note name, avatar photo, nickname, micro signal, region, etc. with identity pointers; (2) the time of WeChat chat records; (3) the complete content of WeChat chat records; (4) for WeChat chat records involved in of text files, pictures, audio, video or transfer, etc., should be clicked to open the display; (5) the time of the cleanliness check and the conclusion of the check.