It is not the Examiner's responsibility to analyze the data for its meaning or significance to the investigation. As scientists, their job is to conduct a thorough and objective examination of a computer and/or computer related evidence to convert it from a digital format into something that the investigator can view. Prompt, Accurate and Impartial Forensic Examinations of Digitally Stored MediaĬomputer Forensic Examiners are scientists.Therefore, CGRCFL Examiners, depending on the circumstances, will either duplicate the media (or copy the information) on-site, or they will bring the electronic equipment to the laboratory where they will duplicate the media and then perform the examination. Duplication, Storage and Preservation of Computers and Computer Related EvidenceĮxaminations are typically conducted on copies of the original evidence because of the possibility that the data may be contaminated.Once the search request is evaluated by the CGRCFL, the Deputy Lab Director will assign it to an Examiner who will then contact the requesting agency.

Under these circumstances, the advance notice requirement is waived, but for scheduling purposes, the more lead-time given to the CGRCFL, the better. However, the CGRCFL understands that there will be times when an agency will unexpectedly discover digital evidence that they are unprepared to manage. Requests for this type of assistance should be made a minimum of 48 hours in advance by filling out a Field Service Request form. The CGRCFL can help with search warrant preparation as it applies to digital evidence-by advising on related language that may be included in the affidavit. Any law enforcement agency operating in the Chicago RCFL's service area is encouraged to request assistance with the following activities.

Form custody chain digital forensic