Forensic Examination of Digital Evidence

FORENSIC EXAMINATION OF DIGITAL EVIDENCE: A GUIDE FOR LAW ENFORCEMENT
8. PERTINENT DATA: (e.g., provide passwords, keyword lists, operating system, nicknames,
computer types, network information, Internet Protocol Address, and any other
information that will assist with the analysis.)
NOTE: If network intrusion detection logs or other detection type logs are associated
with the respective investigation (e.g., ASIM logs, Government Sniffer Logs,
etc.), they should be provided (electronic form preferable, paper is acceptable).This
will enhance the examiner’s ability to provide a better product and to interpret the
logs in an effort to search for the right items.
NOTE: The examiner will conduct only the specific tasks requested. If not specified, then
it will not be done. If obvious items are left off the request, the DCFL will call to verify.
The more detail you provide, the better and more analysis we conduct.
NOTE: Contact your servicing computer expert to aid in creation of this request, if
necessary.
9. ***AUTHORITY: Please indicate the legal basis for DCFL conducting the search you
are requesting. There are generally three bases in criminal cases that would allow DCFL
to perform your request:
1. Search Warrant/Military Search Authority [include supporting affidavits].
2. Consent.
■
■
■
■
■
DoD Banner.
Unit User Agreement.
Written Consent Signed by Authorizer.
Written Record of the Designated Approval Authority or Other Official who has the
Right to Consent to the Search of the Media.
Memorandum of oral consent with special emphasis as to the scope of the consent
granted.
3. Written Memo from servicing legal office stating that there is no reasonable expectation
of privacy in the media submitted.
Inclusion of a copy of documents listed above is mandatory along with the request and
will speed the analysis. Failure to include the same will result in a delay until such time as
DCFL is satisfied that there is a legal basis for conducting the analysis.
10. ***OTHER DOCUMENTS: Requestors MUST provide the form used to open the
investigation within their organization (e.g., provide a copy of an ACISS report, Army
Form 66, or Navy ALS, etc.).
55