Kentucky

Kentucky RCFL

Kentucky RCFLUpon request, the KRCFL will provide digital forensics services and training to any law enforcement agency with jurisdiction in the state of Kentucky.


KRCFL
  440 North Whittington Parkway
  Louisville, KY 40222


Participating Agencies

The Kentucky RCFL is a unique partnership that promotes quality and strengthens computer forensics capacity. Computer forensics professionals from the following organizations are staffing the RCFL:

Local Government

Federal Government

Contact Us

KRCFL
440 North Whittington Parkway
Louisville, KY 40222


Kentucky RCFL
Phone: (502) 423-6740
Fax: (502) 423-6744

Media Inquiries
Members of the media may contact David Beyer on (502) 569-7150 to inquire about specific issues concerning the KRCFL.

Request Assistance

Any law enforcement agency with jurisdiction in Kentucky may request assistance (at no cost to them) with the following activities—

  • Pre-Seizure Consultation – The KRCFL can help with search warrant preparation (only as it applies to digital evidence) by advising on related language that may be included in the affidavit.

  • On-Site Seizure and Collection – Requests for this type of assistance should be made a minimum of 48 hours in advance (the more lead time the better) by submitting a completed Field Service Request Form to the KRCFL. On occasion, an agency will uncover digital evidence that they are unprepared to manage. Under these circumstances, the advance notice requirement is waived. Once the RCFL evaluates the search request, the Operations Manager assigns it to an Examiner for action.

  • Duplication, Storage and Preservation of Electronic Equipment and other Digital Evidence – Examinations are typically conducted on copies of the original evidence. Therefore, RCFL Examiners, can either duplicate (or copy the information) the media on-site, or they will bring the electronic equipment to the laboratory where they will duplicate the media and perform the examination.

  • Prompt, Accurate, and Impartial Examinations of Digitally Stored Media – RCFL Examiners will conduct a thorough and objective examination of an electronic device to locate digital evidence and turn it into something that the investigator can review. It is not the Examiner’s responsibility to analyze the data for its meaning or significance to the investigation. This impartiality and objectivity lends credibility to both their findings and subsequent court testimony.

  • Courtroom Testimony - As records are recovered from seized electronic equipment, the prosecutor is likely to direct the Examiner to introduce the digital evidence into court. As an expert witness, the Examiner explains under oath, how they conducted the forensics examination and what they discovered as a result.

Request Services

Service Request Form

To request any type of assistance from the RCFL, please complete the service request form and submit it via fax or email. Service requests are accepted on a case-by-case basis from any law enforcement agency with jurisdiction in the RCFL’s service area. All requests are prioritized according to the nature of the crime.

Training Requests

Any law enforcement agency in the RCFL's service area may request training. 


Shipping Digital Evidence

When shipping evidence to the laboratory, please contact the RCFL for specific instructions regarding submittal procedures. For most examinations, submit only the central processing units and the internal and external storage media, and remember to:

  • Use a sturdy container when shipping computer components - If possible, use the original packing case with the fitted padding. Use large, plastic bubble wrap or foam rubber pads as packing and never use styrofoam because it lodges inside electronic equipment and creates static charges that can cause data loss or damage to circuit boards. Seal the container with a strong packing tape.
  • Pack and ship central processing units in the upright position - Label the outside container THIS END UP.
  • Secure loose media - Such as disks, cartridges, tapes, hard drives, etc., to avoid movement during shipping.

Tips for Law Enforcement

When Submitting a Service Request Form, the case agent or officer should be as concise and thorough as possible. These forms are used to make decisions about the request, therefore, any vague or ambiguous terminology may make it more difficult to interpret or understand what services are needed. As a result, this could slow down the processing of the request.

Turning On or Accessing a Computer

Indicate on the Service Request Form if you or anyone else in the chain of custody attempted to turn on or access the computer prior to submitting it to the KRCFL. This is very important information for the Examiners to have.

Search Warrants

If a field service request is pursuant to a search warrant, a copy of the warrant must be included with the Field Service Request form. Likewise, if the service request is a result of a consensual search, a copy of the agency's “consent for search” form must be included. Failure to include this documentation will more than likely cause a delay in processing the request.

Handling Sensitive Equipment

Always use extreme caution or take precautionary measures such as grounding the static electricity before touching any of the internal components of the computer or handling sensitive computer equipment. For example, if the internal workings of a computer are exposed, the equipment could be damaged by a buildup of static electricity that is held by the human body. (Walking across a rug can produce a static electricity voltage of up to 12,000 volts.) The hard drive is especially susceptible to static electricity, even if it is exposed to a small amount of voltage, while a microchip can be damaged with as little as 500 volts of static electricity. If you're unsure about how to handle the equipment, then it is best to defer to a professional.


Examination Best Practices

To help the RCFLs provide the level of service its customers have come to expect, click here to review our list of "Examination Best Practices – What Every RCFL Customer Should Know."


Service Area

Upon request, the KRCFL will provide digital forensics services and training to any law enforcement agency with jurisdiction in the state of Kentucky.

Documents & Forms

Kentucky RCFL forms, documents, publications, and brochures.

Documents & Forms - Read More…

Training Courses

The following descriptions describe the various courses that will be offered by the RCFL.


Seizing and Handling of Digital Evidence

Investigators learn how to collect and preserve digital evidence, and to integrate digital evidence into a case. Additionally, investigators are exposed to the advanced tools and techniques used by the RCFL, so they can better understand what to expect from a forensics examination. This course requires no prerequisites, but attendees should have a working knowledge of computers.


Image Scan Training

The FBI's Computer Analysis Response Team (CART) developed the Image Scan system to help investigators locate the presence of picture files that may contain contraband on a computer. This system allows the investigator to view a variety of graphic formats during a consensual search, and protects valuable digital evidence by booting up a computer using the Linux operating system. After mounting the hard drive in a “read only” manner, Image Scan prompts the investigator to search for picture files only. During this process, the tool logs every step taken by the investigator, further documenting what occurred during the search process.

Law enforcement personnel that conduct on-site investigations for child pornography are encouraged to take the Image Scan training. 


Cell Phone Investigative Kiosk Training

Cell phones can contain crucial evidence in your case. Ever wish you could process these devices yourself? You can! Learn how to use the RCFL's self-service Cell Phone Kiosk in this 3-hour class. At the end of the class, you will be able to extract data from a cell phone, put it into a report, and burn the report to a CD or DVD in as little as 30 minutes.


Loose Media Investigative Kiosk Training

Loose media like thumb drives, digital camera media cards, and suspect CDs can contain crucial evidence in your case. Ever wish you could process these yourself? You can! Learn how to use the RCFL's self-service Loose Media Kiosk in this 3-hour class. At the end of the class, you will be able to extract data from loose media, put it into a report, and burn the report to a CD or DVD.


Case Agent Investigative Review (for FTK3)

FTK is one of the tools that the RCFL uses in computer forensic examinations. We believe that the case investigator is the most knowledgeable person to conduct an analysis of digital media to determine its relevance to an investigation. For example, who better to determine that a particular e-mail between two individuals is relevant?

This course provides students with the knowledge and skills necessary to effectively use FTK to conduct a comprehensive review of digital media that has been submitted to and processed by the RCFL. This includes techniques to locate and examine e-mail messages, deleted files, documents, graphic files, as well as searching for key words and phrases.

Training Schedule

Training Schedule for Kentucky RCFL.

Training Schedule - Read More…

Filed under: