A Guide for First Responders

1 Department of JusticeOffice of Justice ProgramsNational Institute of JusticeA Guide for First RespondersNIJ Department of JusticeOffice of Justice Programs810 Seventh Street , DC 20531 John AshcroftAttorney GeneralOffice of Justice ProgramsNational Institute of JusticeWorld Wide Web SiteWorld Wide Web Site photographs copyright 2001 PhotoDisc, Crime SceneiElectronic Crime SceneInvestigation:A Guide for FirstRespondersWritten and Approved by the Technical Working Group for Electronic Crime Scene InvestigationJuly Department of JusticeOffice of Justice ProgramsNational Institute of JusticeOpinions or points of view expressed in this document represent a consensus of theauthors and do not necessarily represent the official position or policies of the of Justice. The products and manufacturers discussed in this document arepresented for informational purposes only and do not constitute product approval orendorsement by the Department of 187736 The National Institute of Justice is a component of the Office of Justice Programs,which also includes the Bureau of Justice Assistance, the Bureau of JusticeStatistics, the Office of Juvenile Justice and Delinquency Prevention, and theOffice for Victims of document is not intended to create, does not create, and may not be relied upon tocreate any rights, substantive or procedural, enforceable at law by any party in any mat-ter civil or Internet, computer networks, and automated data systemspresent an enormous new opportunity for committing criminalactivity.

2 Computers and other electronic devices are being usedincreasingly to commit, enable, or support crimes perpetratedagainst persons, organizations, or property . Whether the crimeinvolves attacks against computer systems, the information theycontain, or more traditional crimes such as murder, money laun-dering, trafficking, or fraud, electronic evidence increasingly isinvolved. It is no surprise that law enforcement and criminal jus-tice officials are being overwhelmed by the volume of investiga-tions and prosecutions that involve electronic assist State and local law enforcement agencies and prosecu-torial offices with the growing volume of electronic crime, aseries of reference guides regarding practices, procedures, anddecisionmaking processes for investigating electronic crime isbeing prepared by technical working groups of practitioners andsubject matter experts who are knowledgeable about electroniccrime. The practitioners and experts are from Federal, State, andlocal law enforcement agencies; criminal justice agencies; officesof prosecutors and district attorneys general; and academic, com-mercial, and professional series of guides will address the investigation process fromthe crime scene First responder, to the laboratory, to the court-room.

3 Specifically, the series of guides will address:uCrime scene investigations by First of digital uses of electronic technology a digital evidence forensic presentation of digital to the rapidly changing nature of electronic and computertechnologies and of electronic crime, efforts will be periodicallyundertaken to update the information contained within each ofthe guides. The guides, and any subsequent updates that are madeto them, will be made available on the National Institute ofJustice s World Wide Web site ( ).iiiForewordTechnical Working Group forElectronic Crime SceneInvestigationThe Technical Working Group for Electronic Crime SceneInvestigation (TWGECSI) was a multidisciplinary group of practi-tioners and subject matter experts from across the United States andother nations. Each of the individual participants is experienced inthe intricacies involved with electronic evidence in relation to recog-nition, documentation, collection, and packaging.

4 To initiate theworking group, a planning panel composed of a limited number of participants was selected to define the scope and breadth of thework. A series of guides was proposed in which each Guide willfocus on a different aspect of the panel chose crime scene investigation as the First topic forincorporation into a PanelvTWGECSIvSusan BallouProgram Manager for Forensic SciencesOffice of Law Enforcement StandardsNational Institute of Standards and TechnologyGaithersburg, MarylandJaime CarazoSpecial AgentUnited States Secret ServiceElectronic Crimes BranchWashington, CraneAssistant DirectorComputer Crime SectionNational White Collar Crime CenterFairmont, West VirginiaFred DemmaNational Law Enforcement and Corrections Technology Center NortheastRome, New YorkGrant GottfriedSpecial ProjectsNational Center for Forensic ScienceOrlando, FloridaSam GuttmanAssistant Inspector in ChargeForensic and Technical Postal Inspection ServiceDulles, VirginiaJeffrey HerigSpecial AgentFlorida Department of Law EnforcementFlorida Computer Crime CenterTallahassee.

5 FloridaTim HutchisonSheriffKnox County Sheriff s OfficeKnoxville, TennesseeDavid IcoveManager, Special TVA PoliceKnoxville, TennesseeviAbigail AbrahamAssistant State s AttorneyCook County State s Attorney s OfficeChicago, IllinoisKeith AckermanHead of CIDP olice HQHampshire ConstabularyWinchester, HantsUnited KingdomMichael AndersonPresidentNew Technologies, IncGresham, OregonBill BaughCEOS avannah Technology GroupSavannah, GeorgiaBob JarzenSacramento CountyLaboratory of Forensic ScienceSacramento, CaliforniaTom JohnsonDeanSchool of Public Safety and Professional StudiesUniversity of New HavenWest Haven, ConnecticutKaren MatthewsDOE Computer Forensic LaboratoryBolling AFBW ashington, PollittUnit ChiefFBI CARTW ashington, PooleDirectorDoD Computer Forensics LaboratoryLinthicum, MarylandMary RileyPrice Waterhouse Coopers, LLPW ashington, SchmidDirectorNational HIDTA ProgramWashington, A. SchmidtCorporate Security OfficerMicrosoft , WashingtonRaemarie SchmidtComputer Crime SpecialistNational White Collar Crime CenterComputer Crime SectionFairmont, West VirginiaCarl SelavkaMassachusetts State Police Crime LaboratorySudbury, MassachusettsSteve SepulvedaUnited States Secret ServiceWashington, ShipleyDetective SergeantReno Police DepartmentFinancial/Computer Crimes UnitReno, NevadaChris StippichComputer Crime SpecialistComputer Crime SectionNational White Collar Crime Center Fairmont, West VirginiaCarrie Morgan WhitcombDirectorNational Center for Forensic ScienceOrlando, FloridaWayne WilliamsSr.

6 Litigation CounselComputer Crime and intellectual property SectionCriminal Department of JusticeWashington, MembersAdditional members were then incorporated into TWGECSI toprovide a full technical working group. The individuals listedbelow, along with those participants on the planning panel,worked together to produce this Guide for electronic crime scene First BishopSpecial Agent in Department of EnergyOffice of Inspector GeneralTechnology Crime SectionWashington, BraniganVice President of Product DevelopmentLucent TechnologiesMurray Hill, New JerseyPaul BrownCyberEvidence, Woodlands, TexasCarleton BryantStaff AttorneyKnox County Sheriff s OfficeKnoxville, TennesseeChristopher BubbDeputy Attorney GeneralNew Jersey Division of Criminal JusticeTrenton, New JerseyDon BuchwaldProject EngineerNational Law Enforcement and Corrections Technology Center WestThe Aerospace CorporationLos Angeles, CaliforniaCheri CarrComputer Forensic Lab ChiefNASA Office of the Inspector GeneralNetwork and Advanced Technology Protections OfficeWashington, CartwrightManagerCanadian Police Research CentreOttawa.

7 OntarioCanadaKen CitarellaChiefHigh Tech Crimes BureauWestchester County District AttorneyWhite Plains, New YorkChuck CoeDirector of Technical ServicesNASA Office of the Inspector GeneralNetwork and Advanced Technology Protections OfficeWashington, CohenSandia National LaboratoriesCyber Defender ProgramLivermore, CaliforniaFred CottonDirector of Training ServicesSEARCHThe National Consortium for Justice Information and StatisticsSacramento, CaliforniaTony CrispLieutenantMaryville Police DepartmentMaryville, TennesseeMark DaleNew York State PoliceForensic Investigation CenterAlbany, New YorkClaude DavenportSenior SAUnited States Customs ServiceSterling, VirginiaDavid DaviesPhotographic ExaminerFederal Bureau of InvestigationWashington, DonhauserMaryland State PoliceColumbia, MarylandJames DoyleSergeantDetective BureauNew York City Police DepartmentNew York, New YorkMichael DuncanSergeantRoyal Canadian Mounted PoliceEconomic Crime BranchTechnological Crime SectionOttawa, OntarioCanadaJim DunneGroup SupervisorDrug Enforcement AgencySt.

8 Louis, MissouriChris DuqueDetectiveHonolulu Police DepartmentWhite Collar Crime UnitHonolulu, HawaiiDoug ElrickIowa DCI Crime LabDes Moines, IowaPaul FrenchComputer Forensics Lab ManagerNew Technologies Armor, , OregonviiiGerald FriesenElectronic Search CoordinatorIndustry CanadaHull, QuebecCanadaPat Gilmore, CISSPD irectorInformation Security Atomic TangerineSan Francisco, CaliforniaGary GordonProfessorEconomic Crime ProgramsUtica CollegeWetStone TechnologiesUtica, New YorkDan HenryChief DeputyMarion County Sheriff s DepartmentOcala, FloridaJeff HormannSpecial Agent In ChargeComputer Crime Resident Army CIDFt. Belvoir, VirginiaMary HorvathProgram ManagerFBI CARTW ashington, JoinerOfficerArizona Department of Public SafetyPhoenix, ArizonaNigel JonesDetective SergeantComputer Crime UnitPolice HeadquartersKent County ConstabularyMaidstone, KentUnited KingdomJamie KerrSGT/Project ManagerRCMP HeadquartersTraining DirectorateOttawa, OntarioCanadaAlan KestnerAssistant Attorney GeneralWisconsin Department of JusticeMadison, WisconsinPhil KiracofeSergeantTallahassee Police DepartmentTallahassee, FloridaRoland LascolaProgram ManagerFBI-CARTW ashington, LeeseDetective SergeantMaryland State PoliceComputer Crimes UnitColumbia, MarylandGlenn LewisComputer SpecialistSEARCHThe National Consortium for Justice Information and StatisticsSacramento, CaliforniaChris MalinowskiForensic Computer InvestigationUniversity of New HavenWest Haven, ConnecticutKevin Simons Island, GeorgiaBrenda MaplesLieutenantMemphis Police DepartmentMemphis.

9 TennesseeTim McAuliffeNew York State PoliceForensic Investigation CenterAlbany, New YorkMichael McCartneyInvestigatorNew York State Attorney General s OfficeCriminal Prosecution Bureau Organized Crime Task ForceBuffalo, New YorkAlan McDonaldSSAW ashington, MenzSEARCHThe National Consortium for Justice Information and StatisticsSacramento, CaliforniaDave MerkelAOL InvestigationsReston, VirginiaBill MoylanDetectiveNassau County PDComputer Crime SectionCrimes Against property SquadWestbury, New YorkixSteve NesbittDirector of OperationsNASA Office of the Inspector GeneralNetwork and Advanced Technology Protections OfficeWashington, NickProgram Customs ServiceCyber Smuggling CenterFairfax, VirginiaRobert O LearyDetectiveNew Jersey State PoliceHigh Technology Crimes & Investigations Support UnitWest Trenton, New JerseyMatt ParsonsSpecial Agent/Division ChiefNaval Criminal Investigative ServiceWashington, PhelanChiefComputer Forensics UnitDEA Special Testing and Research LabLorton, VirginiaHenry R.

10 ReeveGeneral Counsel/Deputy District Attorney s OfficeDenver, ColoradoJim Riccardi, Crime SpecialistNational Law Enforcement and Corrections Technology Center NortheastRome, New YorkDavid RobertsDeputy Executive DirectorSEARCHThe National Consortium for Justice Information and StatisticsSacramento, CaliforniaLeslie RussellForensic Science ServiceLambethLondon, EnglandUnited KingdomGreg SchmidtSr. Investigator EDS-Investigations/Technical Plano, TexasGeorge SidorLaw Enforcement Security ConsultantJaws Technologies Albert, AlbertaCanadaWilliam SpernowCISSPR esearch DirectorInformation Security Strategies GroupGartner, , GeorgiaRonald StevensSenior InvestigatorNew York State PoliceForensic Investigation CenterAlbany, New YorkGail ThackeraySpecial Counsel Technology CrimesArizona Attorney General s OfficePhoenix, ArizonaDwight Van de VateChief DeputyKnox County Sheriff s OfficeKnoxville, TennesseeJay VerhorevoortLieutenantDavenport Police DepartmentDavenport, IowaRichard Vorder BrueggePhotographic ExaminerFederal Bureau of InvestigationWashington, B.