Computer Forensics Program

Recognizing the digital revolution, DEA in October 1994, established a digital evidence program. The initial purpose of this program was to recover information of probative value from computers and magnetic storage media (diskettes, tapes and data cartridges.) However, the need of digital examination services has broadened both in scope and numbers. Presently, the DEA digital evidence program routinely processes a wide variety of computer evidence, including laptops, desktop computers, network servers, diskettes, backup tapes, and data cartridges (Iomega Zip and Jaz, Syquest, Bernoullis, magneto-optical, etc.) In fact, a seized computer doesn't even need to be operational as long as the hard drive or magnetic storage media spins or can be made to spin. The motto of the program is "if it spins then it can be read."

Currently, the DEA digital evidence program is processing almost every conceivable form of non-traditional digital storage device. Many of these do not "spin," but rather hold the information in a volatile memory state and are powered by a limited battery power supply. Examples include answering machines, pagers, cellular telephones with memory functions, smart facsimile machines, copiers, network printers, electronic cash registers, digital cameras, navigational devices (such as GPS), pocket digital assistants (commonly referred to as a pocket organizer or electronic rolodex), palm-top computers, and digital watches which contain name and phone number data. This expansion of DEA's computer forensic support services is a reflection of the broader role that digital technologies have in today's society.

The Digital Evidence Laboratory routinely provides on-site hard drive duplication support when evidence cannot be removed from a business. Additionally, any original evidence can be duplicated at the laboratory in 1-2 workdays and returned if requested. The Digital Evidence Laboratory also provides expert witness testimony as required.