A Guide for First Responders

1 Department of JusticeOffice of Justice ProgramsNational Institute of JusticeA Guide for First RespondersNIJ Department of JusticeOffice of Justice Programs810 Seventh Street , DC 20531 John AshcroftAttorney GeneralOffice of Justice ProgramsNational Institute of JusticeWorld Wide Web SiteWorld Wide Web Site photographs copyright 2001 PhotoDisc, Crime SceneiElectronic Crime SceneInvestigation:A Guide for FirstRespondersWritten and Approved by the Technical Working Group for Electronic Crime Scene InvestigationJuly Department of JusticeOffice of Justice ProgramsNational Institute of JusticeOpinions or points of view expressed in this document represent a consensus of theauthors and do not necessarily represent the official position or policies of the of Justice.

2 The products and manufacturers discussed in this document arepresented for informational purposes only and do not constitute product approval orendorsement by the Department of 187736 The National Institute of Justice is a component of the Office of Justice Programs,which also includes the Bureau of Justice Assistance, the Bureau of JusticeStatistics, the Office of Juvenile Justice and Delinquency Prevention, and theOffice for Victims of document is not intended to create, does not create, and may not be relied upon tocreate any rights, substantive or procedural, enforceable at law by any party in any mat-ter civil or Internet, computer networks, and automated data systemspresent an enormous new opportunity for committing criminalactivity.

3 Computers and other electronic devices are being usedincreasingly to commit, enable, or support crimes perpetratedagainst persons, organizations, or property. Whether the crimeinvolves attacks against computer systems, the information theycontain, or more traditional crimes such as murder, money laun-dering, trafficking, or fraud, electronic evidence increasingly isinvolved. It is no surprise that law enforcement and criminal jus-tice officials are being overwhelmed by the volume of investiga-tions and prosecutions that involve electronic assist State and local law enforcement agencies and prosecu-torial offices with the growing volume of electronic crime, aseries of reference guides regarding practices, procedures.

4 Anddecisionmaking processes for investigating electronic crime isbeing prepared by technical working groups of practitioners andsubject matter experts who are knowledgeable about electroniccrime. The practitioners and experts are from Federal, State, andlocal law enforcement agencies; criminal justice agencies; officesof prosecutors and district attorneys general; and academic, com-mercial, and professional series of guides will address the investigation process fromthe crime scene First responder, to the laboratory, to the court-room.

5 Specifically, the series of guides will address:uCrime scene investigations by First of digital uses of electronic technology a digital evidence forensic presentation of digital to the rapidly changing nature of electronic and computertechnologies and of electronic crime, efforts will be periodicallyundertaken to update the information contained within each ofthe guides. The guides, and any subsequent updates that are madeto them, will be made available on the National Institute ofJustice s World Wide Web site ( ).

6 IiiForewordTechnical Working Group forElectronic Crime SceneInvestigationThe Technical Working Group for Electronic Crime SceneInvestigation (TWGECSI) was a multidisciplinary group of practi-tioners and subject matter experts from across the United States andother nations. Each of the individual participants is experienced inthe intricacies involved with electronic evidence in relation to recog-nition, documentation, collection, and packaging. To initiate theworking group, a planning panel composed of a limited number of participants was selected to define the scope and breadth of thework.

7 A series of guides was proposed in which each Guide willfocus on a different aspect of the panel chose crime scene investigation as the First topic forincorporation into a PanelvTWGECSIvSusan BallouProgram Manager for Forensic SciencesOffice of Law enforcement StandardsNational Institute of Standards and TechnologyGaithersburg, MarylandJaime CarazoSpecial AgentUnited States Secret ServiceElectronic Crimes BranchWashington, CraneAssistant DirectorComputer Crime SectionNational White Collar Crime CenterFairmont, West VirginiaFred DemmaNational Law enforcement and Corrections Technology Center NortheastRome, New YorkGrant GottfriedSpecial ProjectsNational Center for Forensic ScienceOrlando, FloridaSam GuttmanAssistant Inspector in ChargeForensic and Technical Postal Inspection ServiceDulles, VirginiaJeffrey HerigSpecial AgentFlorida Department of Law EnforcementFlorida Computer Crime CenterTallahassee, FloridaTim HutchisonSheriffKnox County Sheriff s OfficeKnoxville, TennesseeDavid IcoveManager, Special TVA PoliceKnoxville.

8 TennesseeviAbigail AbrahamAssistant State s AttorneyCook County State s Attorney s OfficeChicago, IllinoisKeith AckermanHead of CIDP olice HQHampshire ConstabularyWinchester, HantsUnited KingdomMichael AndersonPresidentNew Technologies, IncGresham, OregonBill BaughCEOS avannah Technology GroupSavannah, GeorgiaBob JarzenSacramento CountyLaboratory of Forensic ScienceSacramento, CaliforniaTom JohnsonDeanSchool of Public Safety and Professional StudiesUniversity of New HavenWest Haven, ConnecticutKaren MatthewsDOE Computer Forensic LaboratoryBolling AFBW ashington, PollittUnit ChiefFBI CARTW ashington, PooleDirectorDoD Computer Forensics LaboratoryLinthicum, MarylandMary RileyPrice Waterhouse Coopers, LLPW ashington, SchmidDirectorNational HIDTA ProgramWashington, A.

9 SchmidtCorporate Security OfficerMicrosoft , WashingtonRaemarie SchmidtComputer Crime SpecialistNational White Collar Crime CenterComputer Crime SectionFairmont, West VirginiaCarl SelavkaMassachusetts State Police Crime LaboratorySudbury, MassachusettsSteve SepulvedaUnited States Secret ServiceWashington, ShipleyDetective SergeantReno Police DepartmentFinancial/Computer Crimes UnitReno, NevadaChris StippichComputer Crime SpecialistComputer Crime SectionNational White Collar Crime Center Fairmont, West VirginiaCarrie Morgan WhitcombDirectorNational Center for Forensic ScienceOrlando, FloridaWayne WilliamsSr.

10 Litigation CounselComputer Crime and Intellectual Property SectionCriminal Department of JusticeWashington, MembersAdditional members were then incorporated into TWGECSI toprovide a full technical working group. The individuals listedbelow, along with those participants on the planning panel,worked together to produce this Guide for electronic crime scene First BishopSpecial Agent in Department of EnergyOffice of Inspector GeneralTechnology Crime SectionWashington, BraniganVice President of Product DevelopmentLucent TechnologiesMurray Hill, New JerseyPaul BrownCyberEvidence, Woodlands, TexasCarleton BryantStaff AttorneyKnox County Sheriff s OfficeKnoxville.