Any law enforcement agency operating in the Chicago RCFL's service area is encouraged to request assistance with the following activities—
- Pre-Seizure Consultation
The CGRCFL can help with search warrant preparation as it applies to digital evidence—by advising on related language that may be included in the affidavit.
- On-Site Seizure and Collection
Requests for this type of assistance should be made a minimum of 48 hours in advance by filling out a Field Service Request form. However, the CGRCFL understands that there will be times when an agency will unexpectedly discover digital evidence that they are unprepared to manage. Under these circumstances, the advance notice requirement is waived, but for scheduling purposes, the more lead-time given to the CGRCFL, the better. Once the search request is evaluated by the CGRCFL, the Deputy Lab Director will assign it to an Examiner who will then contact the requesting agency.
- Duplication, Storage and Preservation of Computers and Computer Related Evidence
Examinations are typically conducted on copies of the original evidence because of the possibility that the data may be contaminated. Therefore, CGRCFL Examiners, depending on the circumstances, will either duplicate the media (or copy the information) on-site, or they will bring the electronic equipment to the laboratory where they will duplicate the media and then perform the examination.
- Prompt, Accurate and Impartial Forensic Examinations of Digitally Stored Media
Computer Forensic Examiners are scientists. As scientists, their job is to conduct a thorough and objective examination of a computer and/or computer related evidence to convert it from a digital format into something that the investigator can view. It is not the Examiner's responsibility to analyze the data for its meaning or significance to the investigation. This impartiality and objectivity lends credibility to both their findings and subsequent testimony.
- Courtroom Testimony
As records are recovered from seized digital evidence, the prosecutor is likely to use the Examiner to introduce the computer or computer related evidence into court. As an expert witness, the Examiner can explain, under oath, about how they conducted the examination and what they discovered as a result.
When requesting assistance, as a general rule—
First, contact the CGRCFL to discuss the request and then based on this information, carefully complete and submit one of the following letter or forms according to the type of assistance needed:
- Request Letter
The CGRCFL does not have a standard form for the request letter, rather the agency seeking assistance should generate a letter on their stationary that explains the nature of the request, e.g. an on-site analysis of digitally stored evidence or the submission of digital evidence for examination. The letter must be signed by a supervising agent/officer, and should accompany the Field Service Request Form.
- Field Service Request
Requests for on-site assistance are accepted on a case-by-case basis, regardless of which law enforcement agency in the CGRCFL's service area made the request. The CGRCFL prioritizes each case according to the nature of the crime.
For assistance with a search or field examination, submit this form to the CGRCFL a minimum of 72 hours in advance. Specify whether a seizure of computers/media or an on-site examination is required, and include a copy of the search warrant or other legal authority (e.g. consent form) that authorizes the seizure or collection of the digital evidence with the form. RCFL personnel may not be needed for all search and seizure requests. RCFL personnel will not take custody of any evidence at the scene. The CGRCFL also uses the Field Service Request form to monitor and track cases.
Please note that if a field service request is pursuant to a search warrant, a copy of the warrant must be included with the form. Likewise, if the service request is a result of a consensual search, a copy of the agency consent for search form must be included. Failure to include this documentation will more than likely cause a delay in processing the request.
**Read our new Online Case Submission Form FAQ here.**
Examination Best Practices FAQ Sheet
Administrative Service Request
Any law enforcement agency in the CGRCFL's service area may ask the CGRCFL to conduct training for their personnel about the proper techniques to preserve computer and computer related evidence during a seizure. Simply call the RCFL at 312-913-9270 for further instruction.
Submitting Digital Evidence
Chicago RCFL Evidence Intake Hours:
M-F (9AM - 12PM and 1:00PM - 3:00PM)
Prior to dropping off any evidence at the CGRCFL during Intake Hours, please call (312) 913-9270 and request to speak with the Deputy Lab Director if there are any issues or special circumstances. Shipping evidence is not recommended. Prior to packaging and shipping the evidence, call the CGRCFL for specific instructions regarding submission procedures. For most examinations, submit the central processing units, the hardware and software, plus:
- Use a sturdy cardboard container when shipping computer components. If possible, use the original packing case with the fitted padding. Use large, plastic bubble wrap or foam rubber pads as packing and never use Styrofoam because it lodges inside computers and/or components and creates static charges that can cause data loss or damage to circuit boards. Seal the container with a strong packing tape.
- Pack and ship central processing units in the upright position. Label the outside container THIS END UP.
- Disks, cartridges, tapes, and hard drives should be packed to avoid movement during shipping.
- Label the outer container FRAGILE, SENSITIVE ELECTRONIC EQUIPMENTand KEEP AWAY FROM MAGNETS OR MAGNETIC FIELDS.
- Seal evidence separately from the shipping box or packaging and mark clearly as EVIDENCE.
Tips for Law Enforcement
When submitting a Service Request Form , the case agent or officer should be as concise and thorough as possible. These forms are used to make decisions about the request, therefore, any vague or ambiguous terminology may make it more difficult to interpret or understand what services are needed. This may slow down the processing of the request.
Please indicate on the Service Request Form, any efforts on your part or anyone else in the chain of custody, to turn on or access the computer/evidence prior to submitting it to the Chicago RCFL. This is very important information for the Examiners to have.
Important Note: Exercise caution while handling sensitive computer equipment. In situations where the casing of a computer is open and the internal working are exposed, there is danger of damaging the computer because of the buildup of static electricity that is held by the human body. The hard drive is especially susceptible to static electricity, even if it is exposed to a small amount of voltage, and a microchip can be damaged with as little as 500 volts of static electricity. (Walking across a rug can produce a static electricity voltage of up to 12,000 volts.) Static electricity, at very low levels may not even be felt by a person, but can still cause damage to a hard drive or a microchip. It is best to let a professional handle the equipment or take precautionary measures such as grounding the static electricity before touching any of the internal components of the computer.