Any law enforcement agency operating in the San Diego RCFL's service area can request assistance with the following activities:
- On-Site Seizure and Collection – Requests for this type of assistance should be made a minimum of 48 hours in advance (the more lead time the better) by submitting a completed Service Request form to the San Diego RCFL. On occasion, an agency will uncover digital evidence that they are unprepared to manage. Under these circumstances, the advance notice requirement is waived. Once the San Diego RCFL evaluates the search request, the Operations Manager assigns it to an Examiner for action.
- Duplication, Storage and Preservation of Electronic Equipment and other Digital Evidence – Examinations are typically conducted on copies of the original evidence. Therefore, San Diego RCFL Examiners can either duplicate (or copy the information) the media on-site, or the case agent can submit the electronic equipment to the laboratory where examiners will duplicate the media and perform the examination.
- Prompt, Accurate, and Impartial Examinations of Digitally Stored Media – San Diego RCFL Examiners are trained to conduct a thorough and objective examination of an electronic device to locate digital evidence and turn it into something that the investigator can review. It is not the Examiner's responsibility to analyze the data for its meaning or significance to the investigation. This impartiality and objectivity lends credibility to both their findings and subsequent court testimony.
- Courtroom Testimony – As records are recovered from seized digital evidence, the prosecutor is likely to direct the Examiner to introduce the computer or digital evidence into court. As an expert witness, the Examiner explains under oath, how they conducted the examination and what they discovered as a result.
When requesting assistance, the law enforcement agency should generally contact the RCFL to discuss the request and then based on this information, carefully complete one of the following forms or letters, according to the type of assistance needed:
- Service Request Form — Requests for assistance are accepted on a case-by-case basis from any law enforcement agency in the RCFL's service area. The RCFL prioritizes each request according to the nature of the crime and uses the Service Request form to monitor and track cases.
- Legal Authority - each service request submitted to the RCFL must be accompanied by valid legal authority. If a request is pursuant to a search warrant, please submit the search warrant and affidavit with your request. Likewise, if a request is a result of a consensual search, a copy of your agency’s consent form must be submitted with your request. Failure to include this documentation will cause a delay in processing your request.
Request Letter — Non-participating agencies should write a letter on their stationary that briefly explains the nature of the request. The letter must contain a supervising agent's signature, and can accompany the Service Request Form.
On-Site Assistance — Requests for on-site assistance are accepted on a case-by-case basis from any law enforcement agency in the RCFL's service area. The RCFL prioritizes each request according to the nature of the crime and also uses the Field Service Request form to monitor and track cases.
For assistance with a search or field examination, law enforcement should:
- Submit the Service Request Form to the RCFL at least 48 hours to one week in advance.
- Specify whether a seizure of computers/media or an on-site examination is required.
- Include a copy of the search warrant or other legal authority (e.g. consent form) that authorizes the seizure or collection of the digital evidence with the form.
Shipping Digital Evidence
When possible, evidence should be brought directly to the San Diego RCFL. In certain circumstances where this may not be possible, the evidence may be shipped directly to the San Diego RCFL. When shipping evidence to the San Diego RCFL, please contact us first for specific instructions regarding submittal procedures. For most examinations involving computers, submit only the central processing units and the internal and external storage media, and remember to:
- Use a sturdy container when shipping computer components — If possible, use the original packing case with the fitted padding. Use large, plastic bubble wrap or foam rubber pads as packing and never use styrofoam because it lodges inside electronic equipment and creates static charges that can cause data loss or damage to circuit boards. Seal the container with a strong packing tape.
- Pack and ship central processing units in the upright position — Label the outside container THIS END UP.
- Secure loose media — Such as disks, cartridges, tapes, hard drives, etc., to avoid movement during shipping.
Tips for Law Enforcement
- When Submitting a Service Request Form or an Evidence Custody Form — The case agent or officer should be as concise and thorough as possible. These forms are used to make decisions about the request, therefore, any vague or ambiguous terminology may make it more difficult to interpret or understand what services are needed. As a result, delays in processing the request may occur.
- Turning On or Accessing a Computer — Indicate on the Service Request Form if you or anyone else in the chain of custody attempted to turn on or access the computer prior to submittal. This is very important information for the Examiners to have.
- Handling Sensitive Equipment — Always use extreme caution or take precautionary measures such as grounding the static electricity before touching any of the internal components of the computer or handling sensitive electronic equipment. For example, if the internal workings of a computer are exposed, the equipment could be damaged by a buildup of static electricity that is held by the human body. (Walking across a rug can produce a static electricity voltage of up to 12,000 volts.) The hard drive is especially susceptible to static electricity, even if it is exposed to a small amount of voltage, while a microchip can be damaged with as little as 500 volts of static electricity. If you're unsure about how to handle the equipment--defer to a professional.
Examination Best Practices FAQ Sheet
Loose Media Kiosk
The SDRCFL is now offering the Loose Media Kiosk (LMK) preview tool to investigators. LMK enables users to review evidentiary data found on such items as USB devices, CD/DVDs, flash memory cards, floppy disks and Firewall media. There’s no charge to use the LMK, but investigators should call (858) 638-7400 in advance to use the tool.