Forensic Examination of Digital Evidence

FORENSIC EXAMINATION OF DIGITAL EVIDENCE: A GUIDE FOR LAW ENFORCEMENT
Example 2: DoD Computer Forensics Laboratory (DCFL)
Intake Form
(Form has been edited)
DEPARTMENT OF THE AIR FORCE
DEPARTMENT OF DEFENSE
UNITED
STATES OF AMERICA
AIR FORCE OFFICE OF SPECIAL INVESTIGATIONS
(USE YOUR OWN LETTER HEAD)
MEMORANDUM FOR RECORD DoD Computer Forensics Laboratory
12 June 2000
TO:
DoD Computer Forensics Laboratory (DCFL)
911 Elkridge Landing Road, Suite 300
Linthicum, MD 21090
FROM: Self-Explanatory
SUBJECT: Request Forensic Media Analysis (Complete Unit Investigation Number)
NOTE: Do not remove the captions (the bold face lettering only. Please remove the
explanations.). If no information can be applied to a certain caption, then state N/A or
unknown.
1. ***FULL NAME OF SUBJECT: (If unknown, then state “Unknown.”)
JOHN JIM DOE
2. ***PRIORITY: Explain if there is publicity, high-level interest, or other reasons to
justify placing this investigation ahead of others (e.g., court date, etc.).
3. CLASSIFICATION: Unclassified–Secret–Specialized Compartmented Information, as
it pertains to the investigation, and properly mark all documents.
4. ***CASE AGENT: (This is the “Lead” investigator. For example, if this is a joint investigation,
then provide the identification of the “Lead Investigator” of the “Lead
Investigating Agency.” Provide complete identification and where they are located.) SA
Max Factor, AFOSI Detachment 998, Home AFB, WV, DSN: 234–2345 or Commercial:
(234) 234–2345.
NOTE: The DCFL does not have DSN service yet. Please provide commercial telephone
numbers.
5. ***SYNOPSIS OF THE CASE FACTS: (Brief description of allegation, situation, and
background surrounding the investigation. Provide information that will be useful to the
53