Any law enforcement agency operating in the HARCFL service area may request assistance with the following activities:
- Pre-Seizure Consultation
The RCFL can help with search warrant preparation (only as it applies to computer evidence) by advising on computer related language, which may be included in the affidavit.
- On-Site Seizure and Collection
Requests for this type of assistance should be made a minimum of 48 hours in advance (the more lead time the better) by submitting a completed Field Service Request form. On occasion, an agency will uncover computer evidence that they are unprepared to manage. Under these circumstances, the advance notice requirement is waived. Once the RCFL evaluates the search request, the Operations Manager will assign it to an Examiner for action.
- Duplication, Storage and Preservation of Computers and Computer Related Evidence
Examinations are typically conducted on copies of the original evidence because of the possibility that the data may be contaminated. Therefore, RCFL Examiners, depending on the circumstances, will either duplicate (or copy the information) the media on-site, or they will bring the electronic equipment to the laboratory where they will duplicate the media and then perform the examination.
- Prompt, Accurate and Impartial Forensic Examinations of Digitally Stored Media
Computer Forensic Examiners are scientists. As scientists, their job is to conduct a thorough and objective examination of a computer and/or computer related evidence to convert it from a digital format into something that the investigator can view. It is not the Examiner's responsibility to analyze the data for its meaning or significance to the investigation. This impartiality and objectivity lends credibility to both their findings and subsequent court testimony.
- Courtroom Testimony
As records are recovered from seized computer evidence, the prosecutor is likely to direct the Examiner to introduce the computer or computer related evidence into court. As an expert witness, the Examiner can explain, under oath, about how they conducted the examination and what they discovered as a result.
The HARCFL now provides three distinct methods of examining and reviewing computer evidence. In addition to a traditional forensic examination of digital media, which can be time-consuming and resource intensive, the HARCFL has implemented two additional programs designed to expedite the process of extracting meaningful and relevant information from digital media to facilitate ongoing investigations.
- Case Agent Investigative Review (CAIR) Program
The Case Agent Investigative Review (CAIR) program can assist investigators in advancing their cases, setting leads, establishing probable cause for search and/or arrest warrants, testifying at preliminary hearings, etc. The HARCFL is the first digital forensic laboratory to allow state and local investigators to utilize this program at their desks via a secure law enforcement Internet system. This has proven to be a great time saver both for the laboratory and its customers, and is extremely user-friendly. Through the implementation of this program, the HARCFL has been able to significantly reduce the average amount of time required for results to be returned to the investigator. A one-day training course is required for investigators intending to review their evidence through the CAIR program.*
- Cell Phone and Video Kiosks
Another alternative to a traditional forensic examination offered by the HARCFL is our Cell Phone and Video Kiosks. In those situations where investigators don't require a complete forensic examination, but are still interested in accessing data extracted from a cell phone or still images from a surveillance video or DVD, the laboratory offers self-service kiosks with equipment, supplies and immediate expert assistance. These stations are available to any agency at any time during normal HARCFL business hours. Evidence derived from these devices can be taken that day. Self-service features include—
- Cell phone extraction device
- CD/DVD review and duplication
- Digital extraction and screen capture to produce still images (photographs)
- Conversion of VHS to DVD video
- Preview of media for illicit images or pornography.
Not all cell phones are supported by the tools available in our Cell Phone Kiosk. If you wish, you can lookup the model of your phone on following two websites to see if your phone is supported prior to making your trip to the RCFL:
- How to Request Assistance
- Review our Case Submission FAQs to learn about our case submission policies, what evidence should be submitted or left behind, and more about our CAIR and Kiosk programs.
- To request a traditional examination, CAIR processing, or onsite assistance in the acquisition of digital media, refer to the Case Submissions page and fill out a service request form. Please clearly indicate which type of service is being requested. No service request form is required to use the Cell Phone and Video Kiosks.
* As of March 1, 2008, policy changes were put into place that require the use of CAIR in some cases. Please see the Case Submission FAQs for current information.
Prioritization of HARCFL Cases
Cases and/or evidence submitted to the HARCFL are prioritized for processing and examination based upon the following criteria, regardless of the identity of the agency submitting them:
- Matters involving or affecting national security;
- Imminent credible threat of serious bodily injury or death to persons known or unknown, including examinations of evidence necessary to further the investigation of an at-large or unknown suspect who poses an imminent threat of serious bodily injury or death to persons known or unknown;
- Potential threat of serious bodily injury or death to person(s); I
- mminent credible risk of loss of or destruction to property of significant value;
- Immediate pending court date, or non-extendable, outcome-determinative legal deadline;
- Potential risk of loss of or destruction to property, or exam needed to further the investigation; and,
- No credible potential threat of bodily injury or death to person(s) and/or loss or destruction of property.
An RCFL examiner is highly skilled and may be able to support an investigation by determining:
- The type of computers and operating systems.
- The type of network software, the location of the network servers, and the number of computers on the network.
- Whether encryption and/or password protection was enacted.
Law Enforcement Agencies
When requesting assistance, as a general rule, contact the RCFL to discuss the request and then based on this information, carefully complete one of the following forms or letter according to the type of assistance needed. Due to the time involved to process evidence and maintain the “chain-of-custody,” budgetary and overtime restrictions preclude the acceptance of evidence after 4:30 p.m.
The agency seeking assistance is requested to complete and submit an on-line service request form. The form provides background and related information to assist the HARCFL analyze and prioritize the cases the laboratory accepts for examination. It is the policy of the HARCFL to accept all cases from participating agencies, and cases from non-participating agencies as can be completed by the laboratory in a reasonable period. It is the goal of the HARCFL to provide quality examinations in a timely manner to all of law enforcement.
Download Service Request Form
Shipping Computer Evidence
If the evidence cannot be brought directly to the RCFL* (always phone the RCFL before making the trip to the facility) then prior to packaging and shipping the evidence, contact the RCFL for specific instructions regarding submittal procedures. For most examinations, submit only the central processing units and the internal and external storage media, and:
- Use a sturdy cardboard container when shipping computer components. If possible, use the original packing case with the fitted padding. Use large, plastic bubble wrap or foam rubber pads as packing and never use styrofoam because it lodges inside computers and/or components and creates static charges that can cause data loss or damage to circuit boards. Seal the container with a strong packing tape.
- Pack and ship central processing units in the upright position. Label the outside container THIS END UP.
- Disks, cartridges, tapes, and hard drives should be packed to avoid movement during shipping.
- Highlight our address with yellow highlighter. This signals the package to be routed directly to the evidence room. Do not mark the external package as evidence in any other way. Use the following address only:
Heart of America RCFL
4150 North Mulberry, Suite 250
Kansas City, MO 64116
- Ensure the actual evidence, inside the package, is completely enclosed, packaged, and sealed to evidentiary standards.
- Retain all shipping receipts and use a tracking service.
*Due to the time involved to process evidence and maintain the “chain-of-custody,” budgetary and overtime restrictions preclude the acceptance of evidence after 4:30 p.m.
Tips for Law Enforcement
When Submitting a Service Request Form the case agent or officer should be as concise and thorough as possible. These forms are used to make decisions about the request, therefore, any vague or ambiguous terminology may make it more difficult to interpret or understand what services are needed. As a result, this could slow down the processing of the request.
Turning On or Accessing a Computer
Indicate on the Service Request Form, if you or anyone else in the chain of custody attempted to turn on or access the computer prior to submitting it to the HARCFL. This is very important information for the Examiners to have.
If a field service request is pursuant to a search warrant, a copy of the warrant must be included with the Field Service Request form. Likewise, if the service request is a result of a consensual search, a copy of the agency's “consent for search” form must be included. Failure to include this documentation will more than likely cause a delay in processing the request.
Handling Sensitive Equipment
Always use extreme caution or take precautionary measures such as grounding the static electricity before touching any of the internal components of the computer or handling sensitive computer equipment. For example, if the internal workings of a computer are exposed, the equipment could be damaged by a buildup of static electricity that is held by the human body. (Walking across a rug can produce a static electricity voltage of up to 12,000 volts.) The hard drive is especially susceptible to static electricity, even if it is exposed to a small amount of voltage, while a microchip can be damaged with as little as 500 volts of static electricity. If you're unsure about how to handle the equipment, then it is best to defer to a professional.
Tips for Law Enforcement - Submitting Images to be Reviewed for Identified Children
The United States Postal Inspection Service (USPIS) and the National Center for Missing & Exploited Children (NCMEC) are working together to assist law enforcement agencies and prosecutors with determining if child pornography images contain children who have been identified by law enforcement in past investigations. USPIS Instructions for NCMEC submissions
- Submitting Images to be Reviewed for Identified Children, How to Zip Files for Submission to NCMEC, and Submission Requirements for Newly Identified Victims
Sample Cover Letters