Philadelphia RCFL In-Take Policy
The Philadelphia RCFL accepts digital evidence from the FBI, Pennsylvania state, and local law enforcement agencies for felony cases with these guidelines. No more than 5 evidence items will be accepted per request without prior approval from the PHRCFL Director.
Participating Agencies: The PHRCFL will accept all digital evidence from participating agencies. To submit, bring the PHRCFL Request Form, legal authority (including receipts of property seized for search of location listing evidence items), and the digital evidence to the PHRCFL during evidence intake hours.
Cellular Phones: Participating agencies are strongly encouraged, but not mandated, to use the Cell Phone Kiosk instead of submitting these items to the PHRCFL.
Loose Media: all loose media (DVDs, CDs, Floppy Disks) will not be accepted without prior approval from the Director of the PHRCFL. These should be processed using the Kiosk.
Locked Devices: Participating agencies may submit locked devices to the PHRCFL. If the PHRCFL is unable to unlock, these devices will be submitted to CART headquarter labs for further analysis. All JTAG service requests must acknowledge that the phone may be damaged.
Non-Participating Agencies: The PHRCFL will accept digital evidence from non-participating agencies at the sole discretion of the Director of the PHRCFL. To submit, bring the PHRCFL Request Form, legal authority (including receipts of property seized for search of location listing evidence items), Non-Participating Agency Letter, and the digital evidence to the PHRCFL during evidence intake hours.
Cellular Phones: All non-participating agencies must process their cell phone requests through the Cell Phone Kiosk before making a request to the PHRCFL for a laboratory examination of a cell phone.
Loose Media: all loose media (DVDs, CDs, Floppy Disks) must be processed using the Loose Media Kiosk.
Audio/Visual Enhancements: No requests will be accepted for any audio/visual enhancement work.
Locked Devices: No requests will be accepted for any locked devices including JTAG services.
All work done for non-participating agencies is at the sole discretion of the Director of the PHRCFL based on the specifics of the individual case.
The customer will request what results/services they would like to be performed; the RCFL staff will determine the methods for achieving these results/services.
FBI Philadelphia Police Department
Philadelphia Police Department
Bucks County District Attorney’s Office
Delaware County District Attorney’s Office
Montgomery County District Attorney’s Office
Chester County District Attorney’s Office
Any law enforcement agency with jurisdiction in Eastern Pennsylvania may request assistance (at no cost to them) with the following activities—
- Pre-Seizure Consultation – The PHRCFL can help with search warrant preparation (only as it applies to digital evidence) by advising on related language that may be included in the affidavit.
- On-Site Seizure and Collection – Requests for this type of assistance should be made a minimum of 48 hours in advance (the more lead time the better) by submitting a completed Service Request Form to the PHRCFL. On occasion, an agency will uncover digital evidence that they are unprepared to manage. Under these circumstances, the advance notice requirement is waived. Once the RCFL evaluates the search request, the Operations Manager assigns it to an Examiner for action.
- Duplication, Storage and Preservation of Electronic Equipment and other Digital Evidence – Examinations are typically conducted on copies of the original evidence. Therefore, RCFL Examiners, can either duplicate (or copy the information) the media on-site, or they will bring the electronic equipment to the laboratory where they will duplicate the media and perform the examination.
- Prompt, Accurate, and Impartial Examinations of Digitally Stored Media – RCFL Examiners will conduct a thorough and objective examination of an electronic device to locate digital evidence and turn it into something that the investigator can review. It isnot the Examiner’s responsibility to analyze the data for its meaning or significance to the investigation. This impartiality and objectivity lends credibility to both their findings and subsequent court testimony.
- Courtroom Testimony - As records are recovered from seized electronic equipment, the prosecutor is likely to direct the Examiner to introduce the digital evidence into court. As an expert witness, the Examiner explains under oath, how they conducted the forensics examination and what they discovered as a result.
Non-Participating Agency Request Policy
EFFECTIVE May 1, 2012: All requests for assistance from non-participating agencies must be accompanied by a letter on the submitting agency's letterhead head with the below information. Additionally, the letter must be signed by the Agency head.
Evidence may be submitted to the Philadelphia RCFL without an appointment Monday - Friday 7:30 am to 3:30 pm; before and after this time, coordination is required. Contact our Evidence Custodian at 610-975-3691 for more information.
In order to request RCFL assistance, please completely fill in the RCFL Request Form and submit this along with proper legal authority and the evidence. All fields must be completed on the request form; the most important item is the Service Request block where you list what you want us to do.
Legal authority may consist of:
- Search warrant - If the search warrant is for a premise then a Receipt must also accompany the warrant detailing the evidence that was seized from that location.
- Grand Jury Subpoena
- Court Order
- Other (prior approval from RCFL Director is needed)
After your request is opened, you will receive an email confirmation with the RCFL number and assigned examiner's name. Please coordinate directly with the assigned examiner.
The following downloadable form(s) are required by the PHRCFL.
This is not an all inclusive list. The RCFL can acquire a lot more information, just ask!
Windows, Macintosh, and Linux Computers (including thumbdrives)
- MS SQL
- Office Documents
- By date
- By addressee or domain
- Email attachments
- Web-based email
- Outlook email
- Internet Chat Programs
- Google Chat
- Internet Files
- Browser History
- Temporary files
- Browser Bookmarks
- Cookie files
- Audio files
- Powerpoint presentations
- Deleted files
- Peer to Peer Programs
- Torrent clients
- Child Victim Identification Program files (CP cases only) r />
- Keyword search capability (limit searches to key items that are not generically found in most computer files)
- Registry Information
- System files
- All requested items can be provided by date, user, type, etc. Whatever your case needs, we can provide the analysis in that way.
- Causality Analysis (follow-up request after initial exam)
- Timeline Analysis (follow-up request after initial exam)
- And more — just ask!
iOS Apple Devices (Apple iPhones, iPads, and iTouch)
- Address book contacts
- Text messages (SMS and MMS)
- Deleted text messages (SMS and MMS)
- Safari history and bookmarks
- Web history cache
- Call logs and history
- Device Information (phone number, user name, etc.)
Cellular Telephones (including Blackberries)
** This is all dependent on the make and model of the phone **
- Address book contacts
- Text messages
- Call logs and history
- Internet history and bookmarks
- Device Information (phone number, user name, etc.)
** This is all dependent on the make and model of the device **
- Routes taken
- Saved routes
- Recent locations
Audio and Visual Enhancements
The PHRCFL is capable of enhancing audio and visual media. Please contact the PHRCFL at 610-975-3691 prior to submitting audio and visual requests.
When at a search scene concerning video surveillance equipment the following procedures should be followed for a successful seizure of video footage:
- If possible, do not take the entire DVR system. Video can be exported from teh surveillance system easily. You only need to know the date, time, and camera of which the video footage is contained pertaining to your investigation. You can review the footage utilizing the DVR system's menu options prior to exporting.
- Typically, the menu on the DVR will allow for exportation of a selected time period of footage to USB or CD.
On most DVR systems, there is a menu button on the front of the system (similar to a VHS recorder). The following steps should be followed during the exportation process:
- Review the menu options on the DVR system. It should indicate how and where you can export the video. Typically it is either to CD or USB device.
- Export the video footage in its raw proprietary format. This format will typically not play on a Windows computer. Exporting in the proprietary format allows the video to be copied with no compression. With no compression, a video enhancement has a better chance of success.
- Export the proprietary player from the DVR system. This will allow for viewing the raw video files on a Windows computer.
- Export the video footage in a Windows format (i.e. avi, mpg, mov). This format will have some compression limiting the enhancement capabilities, but will allow you to view the video on a Windows computer.
All images and data contained on the camera and/or cards contained in the camera.
Tips for Law Enforcement
When Submitting a Service Request Form or an Evidence Custody Form, the case agent or officer should be as concise and thorough as possible. These forms are used to make decisions about the request, therefore, any vague or ambiguous terminology may make it more difficult to interpret or understand what services are needed. As a result, this could slow down the processing of the request.
Turning On or Accessing a Computer
Indicate on the Service Request Form, if you or anyone else in the chain of custody attempted to turn on or access the computer prior to submitting it to the PHRCFL. This is very important information for the Examiners to have.
If a service request is pursuant to a search warrant, a copy of the warrant must be included with the Service Request Form. Likewise, if the service request is a result of a consensual search, a copy of the agency's “consent for search” form must be included. Failure to include this documentation will more than likely cause a delay in processing the request.
Handling Sensitive Equipment
Always use extreme caution or take precautionary measures such as grounding the static electricity before touching any of the internal components of the computer or handling sensitive computer equipment. For example, if the internal workings of a computer are exposed, the equipment could be damaged by a buildup of static electricity that is held by the human body. (Walking across a rug can produce a static electricity voltage of up to 12,000 volts.) The hard drive is especially susceptible to static electricity, even if it is exposed to a small amount of voltage, while a microchip can be damaged with as little as 500 volts of static electricity. If you're unsure about how to handle the equipment, then it is best to defer to a professional.
To help the RCFLs provide the level of service its customers have come to expect, download our list of "Examination Best Practices – What Every RCFL Customer Should Know."