What is Digital Forensics?

Digital forensics is the application of science and engineering to the recovery of digital evidence using legally acceptable methods. Examiners use digital investigation and analysis techniques to determine what could be legally permissible evidence on devices ranging from computers and cell phones to other digital media. Examiners are capable of locating deleted, encrypted, or damaged files and data that may serve as evidence in a criminal or national security investigation.

What is a RCFL?

RCFL is a full-service forensics laboratory and training center devoted to the examination of digital evidence, including computers, mobile phones, cameras, and other devices to support the investigation and/or prosecution of a federal, state, or local crime.

What types of crimes does an RCFL help investigate?

RCFL investigations span all types of criminal activity including:

• Terrorism
  
• Child pornography
  
• Crimes of violence
  
• Trade secret theft
  
• Theft or destruction to intellectual property
  
• Internet crimes
  
• Fraud
  
• Financial crimes
  
• Property crimes
   

When was the first RCFL opened?

The first RCFL was established in San Diego, California, in 1999. A second site opened shortly thereafter in Dallas, Texas, in 2000. Today, 17 RCFLs (link to Service Areas) operate throughout the country.

How do I work with an RCFL?

There are 17 RCFLs strategically located across the country. Not every area, however, is represented by an RCFL. RCFLs only work with law enforcement agencies on criminal investigations.

RCFL customers are either participating agencies or non-participating agencies that lie within the service area. Participating agencies help support and staff the RCFL. Non-participating agencies are those that are within the boundaries of the service areas but do not have direct relationship with the RCFL.

Each RCFL has its own policies governing its work with non-participating agencies and agencies that are outside its service area. See the RCFL Service Areas for more details.

How does an RCFL accept cases?

RCFLs examine evidence submitted in criminal investigations only. Contact the closest RCFL Service Area (link) for more information about services provided and how to request assistance.

What are the primary services provided by a RCFL?

RCFLs:

• Conduct a comprehensive examination of digital evidence
  
• Provide a complete and timely report to the contributor
  
• Provide testimony as needed
  
• Act as a regional focal point for digital evidence issues

RCFL examiners can extract information from a computer system or digital media and can often recover deleted, encrypted, or damaged files.

How much does it cost to establish an RCFL?

RCFL start-up costs vary from site to site depending upon the number of personnel assigned, real estate costs, and site preparation/renovation.

Employment Opportunities FAQs

How can I apply for a position with an RCFL?

The RCFL is a cooperative partnership where law enforcement agencies detail individuals to work on a full time basis. The RCFL does not hire individuals to work in these digital evidence laboratories. Individuals who are employed by one of the Participating Agencies are eligible to apply for a position within the RCFL. Candidates are nominated by their agency with the understanding that they will detail the candidate for a specific time period (usually two years). If someone is interested in joining an RCFL, they should first seek career opportunities with the Participating Agencies at the nearest RCFL.

If someone is employed by one of the participating agencies, can they still apply for a detail even if they don't have a background in computers or forensics?

Yes. Although having a computer forensics background is advantageous, this should not preclude someone from applying. Prior computer training, a willingness to learn be a team player, and a commitment to the RCFL's mission, are all important considerations in the hiring process.

How much training does each individual need?

Each new detailee is evaluated as they come on board an RCFL to determine how much training is needed in order to receive the Computer Analysis Response Team/Digital Forensic Examiner Certification. That assessment serves as the basis for a training plan. As part of the training plan, each examiner trainee receives more than ten weeks of training during their first year as a part of this certification curriculum.