1. Managing Digital Evidence: What Every Law Enforcement Executive Must Know Preparedness Toolkit

2. Introduction
The Regional Computer Forensics Laboratory (RCFL) National Program Office created this toolkit to help law enforcement executives assess their staff’s knowledge about managing digital evidence – and complements the Webcast entitled “Managing Digital Evidence: What Every Law Enforcement Executive Must Know”
This toolkit also identifies what digital forensics resources are available to executives

3. Toolkit Contents
To increase their digital forensics preparedness, Executives can follow four steps—
Step #1: Create a Baseline
Step #2: Get Smart
Step #3: Obtain Resources
Step #4: Build Capacity

4. Step #1: CREATE A BASELINE

5. Step #1: Create a Baseline
Assess Your Staff’s Digital Forensics Know-How
Start by polling your evidence technicians, first responders, crime scene experts and mid-level managers about their knowledge of basic digital evidence practices
Establish a digital forensics primary point-of-contact within your Department

6. Step #1: Create a Baseline
Assess Your Staff’s Digital Forensics Know-How
- Review the volume and nature of your Department’s routine casework to identify staffing levels, technical needs, and training requirements.

7. Step #1: Create a Baseline
Determine If The Right Personnel Are Trained In How To Identify Digital Evidence
Are departmental digital forensics resources available to staff members, e.g. manuals, guides, policies, best practices? If not, ask you primary point of contact to create a central repository with this type of documentation

8. Step #1: Create a Baseline
Handling Digital Evidence
Do you have dedicated personnel who know how to properly handle digital evidence without altering or changing it?

9. Step #1: Create a Baseline
Does your Department have adequate supplies to package, protect and secure digital evidence for transport?

10. Step #1: Create a Baseline
Does your evidence storage facility have adequate ventilation and/or power to properly maintain digital evidence to prevent the destruction or loss of volatile data?

11. Step #1: Create a Baseline
Does Your Staff Have Well Stocked Digital Media Recovery Field Kits? Items Should Include—
Regular pliers
Digital camera
Screwdrivers with assorted bits
Needle nosed pliers
Wire cutters
Tamper resistant tape
Masking tape/blue Tape
Flashlight
Pen with indelible ink (sharpie)
Hard drive storage cases

12. Step #2: GET SMART

13. Step #2: Get Smart
Many Resources Are Available to Law Enforcement For Digital Forensics Training - From The Basic To The Sophisticated
- While general Windows based computer forensic training and/or certification programs do exist, there are several areas of specialized training to consider such as Macintosh, Unix or Linux, Cell Phones, PDAs and/or Audio & Video examinations

14. Step 2: Get Smarter - Think RCFL!
The RCFL Program offers a free, basic digital forensic Webcast to all law enforcement personnel – request an online copy or DVD, visit
The program also offers a free field guide – also available upon request on our web site

15. Step 2: Get Smarter - Think RCFL!
Each RCFL offers a variety of free regional training courses, such as first responder training which covers proper techniques for the collection and preservation of digital evidence

16. Step #3: OBTAIN RESOURCES

17. Step #3: Obtain Resources
Work Space – Is There Adequate Work Space Within Your Department Where Evidence Can Be Examined?
- Ideally, each Examiner should have 300 square feet of isolated work space to work with and safeguard original digital evidence
- Does the work space have adequate AC and power? Insufficient AC and power can cause system failures or crashes—resulting in the loss of digital evidence

18. Step #3: Obtain Resources
Equipment
- Work Stations - Ideally, each Examiner has two examination work stations, one administrative computer, one field computer or laptop device, at least one forensic software license, digital camera, and various backup or storage devices

19. Step #3: Obtain Resources
Funding
Can you spend approximately $25, per designee for initial software and hardware equipment costs?
- Can you spend approximately $7, per designee annually for supplies, software license renewals and equipment upgrades or refresh?
If funding is an issue, consider joining an RCFL as a way to obtain digital forensics resources without spending millions…

20. Step #3: Obtain Resources - Become A Participating Agency In An RCFL
Training - RCFLs provide assignees with over 300 hours of initial training, including state-of-the-art training facilities, standardized testing and one-on-one mentoring from highly skilled and experienced forensic examiners at no cost to the participant agency
Annual Equipment Refresh and/or Upgrades - Are provided to each RCFL assignee. Additionally, media costs for the reproduction and presentation of examination findings is provided at no cost to the participant agency

21. Step #4: BUILD CAPACITY

22. Step #4: Build Capacity Consider The RCFL Alternative
Building a digital forensics lab could costs million
The RCFL Program trains and certifies staff and offers a mentorship program that is second to none

23. Step #4: Build Capacity
Each RCFL assignee is furnished over $25, equipment and software with a periodic refresh to ensure that all equipment remains current at no cost to the participant agency. Designees with specialized
training, receive additional
equipment to support
each specialty

24. Step #4: Build Capacity
The average RCFL provides a state-of-the-art work environment with over 15,000 square feet of work space

25. Step #4: Build Capacity
Participating Agencies and Their Personnel Receive—
Overtime
Use of a vehicle and cell phone while on duty
Training as an FBI certified Examiner
High priority for their investigations
Examiners bring their experience and expertise back to their home agencies

26. Step #4: Build Capacity
If an organization can’t assign a staff person to the RCFL – they can still become a participating agency by contributing funding…
This ensures that their investigations will receive top priority

27. Step #4: Build Capacity
RCFLs Are a Force Multiplier – It’s more cost effective to pay the salary of an RCFL detailee, thereby gaining access to the laboratory - than to build a facility from scratch and to maintain it

28. Summary
Digital evidence is here to stay. Executives must take action now—
Create a baseline
Get smart, get training
Obtain resources
Build capacity
Join the RCFL Program

29. For More Information
Visit to view a directory of all RCFL locations
Schedule a tour of your local RCFL
Call the RCFL National Program Office on for further information