REGION: Escondido joins regional computer forensics lab

When Escondido teen Amber Dubois disappeared in February, detectives sent the family's computer to the Regional Computer Forensics Laboratory in San Diego. Forensic experts there quickly determined that the household's Internet use had spiked in the week before Amber went missing, leading detectives to seek her e-mails and chat records from Yahoo. While Amber's case was given a quick turnaround — the search for the missing Escondido High School student continues — local police detectives say that computer forensic examinations are not just for high-profile cases.

REGION: Escondido joins regional computer forensics lab
Oceanside also may assign full-time detective


Source: northcountytimes.com
By SARAH GORDON - sgordon@nctimes.com
Sunday, July 12, 2009 5:07 PM PDT

When Escondido teen Amber Dubois disappeared in February, detectives sent the family's computer to the Regional Computer Forensics Laboratory in San Diego.

Forensic experts there quickly determined that the household's Internet use had spiked in the week before Amber went missing, leading detectives to seek her e-mails and chat records from Yahoo.

While Amber's case was given a quick turnaround ---- the search for the missing Escondido High School student continues ---- local police detectives say that computer forensic examinations are not just for high-profile cases.

Drug dealers, child pornographers, murderers and fraudsters: These days, all kinds of criminals leave digital traces of their deeds.

Law enforcement officials say processing computers, DVDs, CDs and other digital evidence has become a full-time job, and the regional lab is the place best equipped to do it. Last year, the lab had 822 requests for service and reviewed about 4,800 pieces of media, said its director, Craig Porter.

Beginning this week, Detective Damon Vander Vorst, one of 30 full-time detectives from the Escondido Police Department, will work at the lab.

"The lab obviously has the ability to bring in the most updated equipment and the most updated training and other technicians who have expertise in certain areas we may not," Escondido Lt. Craig Carter said.

The Oceanside Police Department says it also is considering assigning an officer to the regional facility, located in Kearny Mesa.

What Escondido gets

The San Diego lab, established in 1998, is run by the FBI and staffed by 22 forensic examiners from federal, state and local agencies. Training, equipment and the lab's administrative costs are paid by the federal government, while each examiner is "donated" by his or her home agency.

The examiners perform forensic analysis of hard drives, CDs and other digital media for area law enforcement. Sometimes, that means recovering deleted files; other times, it means reviewing thousands of files in different formats to find information relevant to a crime.

While any agency can submit evidence to the lab, those that support the lab with a staff member get priority, center director Porter said.

From July 2007 through June 2008, the last period for which Carter had statistics, Escondido detectives asked the lab to analyze digital media in 14 investigations, including six sex offense cases, four child pornography cases, one homicide, one forgery case, one embezzlement case and one counterfeiting case.

Carter said Vander Vorst also conducted forensic analysis of digital media in numerous other Escondido cases.

Now, when Escondido needs digital evidence analyzed, Vander Vorst or other analysts will do the work at the Kearny Mesa center, Carter said.

Escondido will continue to pay Vander Vorst's salary while he works at the lab. Carter said he thinks the Escondido Police Department will be getting a good deal.

"We're looking forward to getting a lot out of it," Carter said.

The lab has funding to update or replace its technology every two years, Porter said. That's something the Escondido Police Department can't afford, Carter noted.

Vander Vorst will receive the same seven-week technical training that the FBI's certified computer forensics examiners get. When Escondido submits evidence for digital analysis, the lab will have 22 experts to tackle it.

The lab also covers the cost of a car and cell phone for its examiners.

The team approach

It is not unusual for local police agencies to commit personnel to work on regional teams, though department leaders say they must weigh the pros and cons before joining any collaboration. The Escondido Police Department has four detectives assigned full time to regional teams: including the North County Gang Task Force, the Regional Auto Theft Task Force and the Narcotics Task Force.

Lt. Mike Goldsmith of the Oceanside Police Department said he thinks Oceanside should join the lab, even though it would mean reassigning one of about 22 detectives to San Diego. He said he is preparing a proposal for Chief Frank McCoy to consider.

Right now, Oceanside has one detective who reviews all digital media seized during an investigation or after an arrest, Goldsmith said.

That detective has four open cases involving seven computers, and copying and viewing files from one computer can take a day or two of the investigator's time, Goldsmith said.

He said the lab could do basic and advanced computer forensics work more efficiently.

"Instead of having one guy looking into all these computers, we can send these multiple computers and have multiple guys looking at them," he said.

Goldsmith said he also liked the idea that the lab would give an Oceanside detective advanced training that he or she could bring back to the department.

"In the long run, we're going to have those experienced people coming back to us," he said.

Call staff writer Sarah Gordon at 760-740-3517.