Anton Piller orders in BC: a forensics execution guide

When BC counsel obtains an Anton Piller order, the forensic team is the technical execution arm. Our role is to attend the execution, image the relevant devices on-site, document chain of custody for the court, and prepare an examiner affidavit for the next return date. The legal architecture and supervision come from counsel and the supervising solicitor. The forensic preparation, on-site imaging, and post-execution preservation are what makes the order's evidentiary value real. This guide walks through the practical workflow.

Table of contents

1. The Anton Piller framework in Canada
2. The forensic team's role
3. Pre-execution preparation
4. On-site execution
5. Post-execution preservation
6. The examiner affidavit
7. Common execution challenges
8. FAQ

1. The Anton Piller framework in Canada

The Anton Piller order is an extraordinary civil remedy. It permits a plaintiff to enter a defendant's premises without notice and seize evidence that might otherwise be destroyed. The Supreme Court of Canada confirmed the framework in Celanese Canada Inc. v. Murray Demolition Corp., 2006 SCC 36.

Granted only in exceptional cases, the Anton Piller order requires:

• A strong prima facie case.
• Very serious potential damage from the alleged conduct.
• Clear evidence that the defendant possesses incriminating materials.
• A real possibility the defendant will destroy them before the discovery process can reach them.

The execution must be conducted by an independent supervising solicitor, with strict safeguards: limits on what can be searched, opportunity for the defendant to consult counsel, careful inventory of what is seized, and prompt return to court for further direction.

In BC, Anton Piller orders are issued by the BC Supreme Court under its inherent jurisdiction, with applications usually heard ex parte and in camera.

2. The forensic team's role

Our role is the technical execution arm. We do not draft the order, supervise the execution, or make legal judgments during the execution. Those are counsel's roles and the supervising solicitor's role.

What we do:

• Pre-execution scoping with counsel and the supervising solicitor.
• On-site forensic imaging of every device within the order's scope.
• Chain of custody documentation from the moment of contact through return.
• Sealed evidence preservation pending the court's directions.
• Post-execution examiner affidavit for the next return date.

Coordination with the supervising solicitor is essential throughout. The supervising solicitor is the court's eyes and ears at the execution.

3. Pre-execution preparation

The forensic preparation begins as soon as counsel signals an Anton Piller application is being prepared. We need:

• The scope of the order (or the draft scope) so we know what devices to expect.
• Intelligence on the defendant's environment if available (number of devices, types, locations).
• The execution date and location so we can scope equipment and personnel.
• Coordination with the supervising solicitor on the on-site protocol.

Equipment to deploy typically includes:

• Hardware write-blockers for every interface we expect to encounter (SATA, USB, NVMe).
• Sterile target media in volumes sufficient for the expected devices, plus margin.
• Forensic imaging tools (Cellebrite for mobile, Magnet AXIOM or EnCase for endpoints).
• Tamper-evident evidence bags and seals with serial numbers.
• Photo documentation equipment (camera or smartphone with timestamping).
• Chain-of-custody forms and pens.

We arrive 30 to 60 minutes before the scheduled execution time to set up and brief the execution team.

4. On-site execution

The execution begins when counsel and the supervising solicitor enter the premises and present the order to the defendant. The defendant has the opportunity to consult counsel before the execution proceeds.

Once the execution begins, the forensic team:

1. Identifies in-scope devices with the supervising solicitor's direction. Devices outside the order's scope are not touched.
2. Photographs each device in its current state at the moment of contact.
3. Images each device with appropriate write-blockers and tools. For desktop and laptop endpoints, we usually image to sterile target drives at the location. For phones, we may image on-site or transport sealed to the lab depending on the device and the order.
4. Records hash values for each image at acquisition.
5. Seals each device in a tamper-evident bag with the seal serial recorded.
6. Logs each step in the chain-of-custody record signed by the examiner and the supervising solicitor.

Throughout the execution, we maintain a separate working space from the defendant and counsel to avoid any appearance of contamination.

5. Post-execution preservation

After the execution, every imaged device and every forensic image is transported to our Langley lab under documented chain of custody. The originals are sealed in our secured evidence storage. Working copies are retained on encrypted storage.

No analysis begins until counsel and the court permit. Anton Piller orders typically include a "no analysis" period during which the seized evidence is preserved pending the next return date.

If the defendant or the court orders return of any items, the return is documented with signatures and a final inventory.

6. The examiner affidavit

For the next return date, we prepare a sworn examiner affidavit covering:

• The scope of the execution.
• The methodology used to image each device.
• The hash values at acquisition.
• The chain of custody from on-site through current preservation.
• The current status of the evidence (sealed, retained, no analysis performed).
• A list of the items imaged with descriptions sufficient to identify them.

The affidavit is filed in the BC Supreme Court (or wherever the order originated) in support of the next application, which often seeks permission to begin analysis.

7. Common execution challenges

Anton Piller executions rarely go exactly as planned. Common challenges:

• Devices outside the expected inventory. A defendant may have more devices than counsel anticipated. We image what is in scope and refuse what is not.
• Encrypted devices. Some endpoints may be encrypted at acquisition time. We image as-is and note encryption status; decryption happens later under court direction.
• Server environments. A small server room can require hours of imaging time. We pre-allocate that time in the schedule.
• Cloud accounts. The order may reach the defendant's cloud accounts. Cloud preservation runs in parallel with on-site device imaging.
• Defendant cooperation issues. The supervising solicitor manages the defendant's cooperation. We continue technical work where authorized.

A well-prepared forensic team can keep the execution moving even when the on-site situation differs from the plan.

Reference: Celanese Canada Inc. v. Murray Demolition Corp., 2006 SCC 36. BC Supreme Court Civil Rules.

8. FAQ

Q: How quickly can you scope an Anton Piller execution? A: Within hours when the matter is urgent. We have moved on Anton Piller engagements within 48 hours of initial counsel contact.

Q: Do you have on-site imaging equipment ready to deploy? A: Yes. We maintain a full Anton Piller kit at our Langley lab and can deploy on short notice.

Q: Can you image cloud accounts as well as devices? A: Yes, when the order's scope reaches them. Cloud preservation typically runs in parallel with on-site device imaging.

Q: What happens to the seized evidence between execution and analysis? A: It is held in our secured evidence storage under documented chain of custody, with no analysis performed until counsel and the court permit.

Q: Can your examiner give evidence at subsequent applications? A: Yes. The post-execution affidavit is the standard deliverable, and the examiner can give viva voce evidence at hearings if required.

Related posts

• Chain of custody for digital evidence in Canada
• How to preserve mobile phone evidence: a checklist
• Departing employee data theft: 12 signs and the playbook

CTA strip

Headline: Have an Anton Piller execution coming up? Primary CTA: Book a confidential consultation Secondary text: Or call (604) 800-9060