Upon request, the Northwest RCFL will provide computer forensics services to any law enforcement agency operating in Oregon and the Southwest Washington area.
1201 NE Lloyd Boulevard
Portland, Oregon 97232
Benefits of participation in an RCFL are numerous. Partner agencies contribute personnel and resources to staff and maintain the operations of the NWRCFL.
- Beaverton Police Department
- Canby Police Department
- Clackamas County Sheriff's Office
- Hillsboro Police Department
- Multnomah County Dept. of Community Justice
- Oregon State Police
- Portland Police Bureau
- Washington County Sheriff's Office
For more information about the NWRCFL, contact:
Acting Director: Matthew Schlegel
Locations and Directions
The Northwest RCFL is located at 1201 NE Lloyd Boulevard, Suite 600, Portland, Oregon 97232.
Google Map Directions
Any law enforcement agency operating in the Northwest RCFL's service area may request assistance with the following activities–
- Pre-Seizure Consultation– The RCFL can help with search warrant preparation (only as it applies to digital evidence) by advising on related language that may be included in the affidavit.
- On-Site Seizure and Collection– Requests for this type of assistance should be made a minimum of 48 hours in advance (the more lead time the better) by submitting a completed Field Service Request Form to the RCFL. On occasion, an agency will uncover digital evidence that they are unprepared to manage. Under these circumstances, the advance notice requirement is waived. Once the RCFL evaluates the search request, the Operations Manager assigns it to an Examiner for action.
- Duplication, Storage and Preservation of Electronic Equipment and other Digital Evidence– Examinations are typically conducted on copies of the original evidence. Therefore, RCFL Examiners, can either duplicate (or copy the information) the media on-site, or they will bring the electronic equipment to the laboratory where they will duplicate the media and perform the examination.
- Prompt, Accurate, and Impartial Examinations of Digitally Stored Media– RCFL Examiners are scientists—and as such, their job is to conduct a thorough and objective examination of an electronic device to locate digital evidence and turn it into something that the investigator can review. It is not the Examiner’s responsibility to analyze the data for its meaning or significance to the investigation. This impartiality and objectivity lends credibility to both their findings and subsequent court testimony.
- Courtroom Testimony– As records are recovered from seized digital evidence, the prosecutor is likely to direct the Examiner to introduce the computer or digital evidence into court. As an expert witness, the Examiner explains under oath, how they conducted the examination and what they discovered as a result.
When requesting assistance, the law enforcement agency should first contact the RCFL to discuss the request, and then carefully complete one of the following forms or letters–
Request Letter– The requesting agency should write a letter on their stationary that explains the nature of the request. The letter must contain a supervising agent’s signature, and can accompany either the Field Service Request Form.
Field Service Request Form– Requests for on-site assistance are accepted on a case-by-case basis from any law enforcement agency in the RCFL's service area. The RCFL prioritizes each request according to the nature of the crime and uses the Field Service Request Form to monitor and track cases.
Training Requests– Any law enforcement agency in the RCFL’s service area may request training. Simply contact the RCFL via phone or email. Upon receipt, an RCFL official will follow up with the requesting agency.
The following downloadable forms are used by the Northwest RCFL.
Tips for Law Enforcement
- When Submitting a Service Request Form - The case agent or officer should be as concise and thorough as possible. These forms are used to make decisions about the request, therefore, any vague or ambiguous terminology may make it more difficult to interpret or understand what services are needed. As a result, this could slow down the processing of the request.
- Turning On or Accessing a Computer– Indicate on the Service Request Form, if you or anyone else in the chain of custody attempted to turn on or access the computer prior to submitting it to the RCFL. This is very important information for the Examiners to have.
- Search Warrants– If a field service request is pursuant to a search warrant, a copy of the warrant must be included with the Field Service Request form. Likewise, if the service request is a result of a consensual search, a copy of the agency's “consent for search” form must be included. Failure to include this documentation will more than likely cause a delay in processing the request.
- Handling Sensitive Equipment– Always use extreme caution or take precautionary measures such as grounding the static electricity before touching any of the internal components of the computer or handling sensitive computer equipment. For example, if the internal workings of a computer are exposed, the equipment could be damaged by a buildup of static electricity that is held by the human body. (Walking across a rug can produce a static electricity voltage of up to 12,000 volts.) The hard drive is especially susceptible to static electricity, even if it is exposed to a small amount of voltage, while a microchip can be damaged with as little as 500 volts of static electricity. If you're unsure about how to handle the equipment, then it is best to defer to a professional.
The NWRCFL offers the following training courses. Law enforcement personnel in the NWRCFL's service area may register on-line for any of the courses below:
Digital Evidence Processing
This course teaches investigators how to collect and preserve digital evidence, and to integrate digital evidence into a case. Additionally, investigators are exposed to the advanced tools and techniques used by the NWRCFL, so they can better understand what to expect from a forensics examination. This course requires no prerequisites, but attendees should have a working knowledge of computers.
Digital Evidence Briefing for Law Enforcement Executives (Lieutenant and above)
This training provides law enforcement executives with the information they need to identify, access, and ultimately address their agency's digital evidence need. This course provides an overview of digital evidence and the practice of computer forensics; evidence handling challenges; legal issues pertaining to digital evidence; and technologies associated with imaging, processing, digital video, encryption, and, various review techniques.
Image Scan Training
The FBI's Computer Analysis Response Team (CART) developed the Image Scan system to help investigators locate the presence of picture files that may contain contraband on a computer. This system allows the investigator to view a variety of graphic formats during a consensual search, and protects valuable digital evidence by booting up a computer using the Linux operating system. Law enforcement personnel that conduct on-site investigations for child pornography would benefit from Image Scan training.