  Criminal investigations are inherently complex as they typically involve
interactions among various actors like investigators, prosecutors, and
defendants. The pervasive integration of technology in daily life adds an extra
layer of complexity, especially in crimes that involve a digital element. The
establishment of digital forensics as a foundational discipline for extracting
digital evidence further exacerbates the complex nature of criminal
investigations, leading to the proliferation of multiple scenarios. Recognising
the need to structure standard operating procedures for the handling of digital
evidence, the representation of digital forensics as a protocol emerges as a
valuable opportunity to identify security and privacy threats. In this paper,
we delineate the protocols that compose digital forensics within a criminal
case, formalise them as message sequence charts (MSCs), and identify their
functional requirements.
