Showing posts with label digital forensics. Show all posts
Showing posts with label digital forensics. Show all posts

Friday, September 26, 2025

Phone Forensics: Diving Into Digital Evidence

This is the seventh installment in a series of profiles featuring DEA special agents, diversion investigators, chemists, and more. Learn about the tough but fulfilling, fascinating, and vital work these DEA personnel do, as well as the many different ways to get involved in fighting drug misuse. For our seventh profile, we will be interviewing Senior Examiner Laura from the Digital Evidence Lab.

What motivated you to join the DEA?

When I was in college, I knew I wanted to end up in law enforcement forensics. I was not interested in the other options at the time such as incident response, network forensics, or private/contract work. There are a lot of different opportunities for digital forensics in law enforcement, but the types of cases vary between organizations. I had previously worked other case types that were emotionally draining and I was looking forward to a change of ‘scenery’ while still working on criminal cases. The diversity of case types and the ability to travel globally were major selling points for me. I also really enjoy working with case agents in the field, either when I’m on-site with them or analyzing evidence that they couldn’t get into.

What does an average day on the job look like for you?

There’s a lot of variety in an average day. Generally, at our lab we support law enforcement investigations by acquiring (copying and preserving), processing, and analyzing digital evidence such as computers, phones, and servers. Any given day could be a combination of these. We occasionally get called to testify in court as expert witnesses.

I have specialized training in mobile device processing and analysis, so those are the types of exhibits I typically handle now. In addition to case work, my group and I have been working to develop and present training to the field (non-digital forensics folks) regarding digital evidence and mobile devices. The schedule at the lab is flexible but we have core hours during the day when we can be reached. Most recently I’ve been focusing more on training than exhibit handling, but when I have mobile devices, I check them to see if any are finished processing so I can review the data. I make sure to communicate with the submitting case agent to find out what kind of information they’re specifically interested in. Report writing and detailed notes are part of our everyday life at the lab.

What has been your proudest moment at the DEA thus far?

My proud moments come anytime I help someone. I reach out to colleagues to get their input if I’m stuck on something, so it’s nice to be able to return the favor. It’s difficult to describe, but I am also proud when I am able to get into a particularly difficult device- whether it’s locked, encrypted, broken and needs repair, or generally troublesome. I try not to give up easily on difficult devices and it is always nice when perseverance pays off.

How can young people who are interested in becoming a forensic examiner at DEA best prepare themselves for the positions?

DEA has three different forensic disciplines: digital, chemistry, friction ridge/fingerprints; first you’ll have to decide what kind of forensics you’re interested in. If you choose digital forensics, you should be familiar with the fundamental principles for digital forensics. A passion and willingness to learn are really important in our field because technology changes so fast, you have to be willing to keep up. We have a lot of processes and procedures that require a keen attention to detail. Being a team player is helpful because we rarely work alone, and constantly talk to colleagues about what we’re working on. Other than those skills, a degree or certifications would help set you apart from other applicants but aren’t a requirement to start working at the lab. We have a robust training program here; we’re willing to teach you as long as you’re willing to learn.

The synthetic opioid fentanyl – often mixed into other drugs – is now responsible for tens of thousands of American deaths per year. How has the fentanyl epidemic changed your job?

There have been drastic changes in the amount of evidence we’re seeing related to fentanyl. When someone overdoses, we often get their phone for any number of reasons: to get information about the source of the drug (the potential dealer, recent contacts, unknown numbers, locations, etc.) or to figure out who it belonged to if there were multiple victims. Fentanyl has made drug use so much more dangerous than it was to begin with and we see the unfortunate consequences all too often here at the lab.

Friday, August 19, 2011

DC3 Digital Forensics Challenge Update

By Carla Voorhees

Carla Voorhees is a web strategist at the Defense Media Activity.

The Digital Forensics Challenge ends on November 2nd, 2011!

The DOD Cyber Crime Center (DC3) is sponsoring their annual Digital Forensics Challenge, and if you submit your solutions by Oct. 2, you’ll receive a 5 percent bonus to your total points score. If you can’t make the October deadline, no worries; just make sure to have your solutions in by Nov. 2.

The challenge is open to individuals or teams of up to four people, and is scored based on total points accumulated. There are 23 individual scenario-based, progressive-level exercises to work though with tasks like “windows registry analysis” on the easy end, and “encrypted drive recover” on the hard end. There are some great prizes available including trips to the 2012 DOD Cyber Crime Conference, the Hacker Halted Conference, courseware, memberships to professional organizations and Dell Streak 7 tablets.
DC3 is sponsoring these exercises as a call to the digital forensics community to pioneer new investigative tools, techniques, and methodologies.

You can find out more about the challenge, sponsors, eligibility requirements, prizes, and team affiliations at the DC3 Challenge website.

Tuesday, May 31, 2011

Digital Forensics: Regional Labs Help Solve Local Crimes

In 2008, Illinois police received disturbing information about a Chicago woman who had taken a 3-year-old to a “sex party” in Indiana where the child and an 11-year-old girl were abused by three adults. However, by the time the tip was received, the crime had already occurred, and there seemed to be no evidence to support criminal charges.

But there was evidence, buried deep within the woman’s computer, and examiners from our Regional Computer Forensics Laboratory (RCFL) in Chicago found it—a deleted e-mail titled “map to the party” that contained directions to an Indiana hotel. The evidence led to charges against all three adults, who were later convicted of aggravated sexual abuse and are currently in prison serving life sentences.

“That’s just one example of what we do every day,” said John Dziedzic, a Cook County Sheriff’s Office forensic examiner who is the director of the Chicago RCFL. “Evidence we produce here—and testify to in court—is crucial in a variety of major investigations.”

The FBI established the first RCFL in San Diego in 2000, and today there 16 Bureau-sponsored labs located around the country, staffed by agents and other federal, state, and local law enforcement agencies (see sidebar).

Each facility is a full-service forensics laboratory and training center devoted to examining digital evidence in support of investigations—everything from child pornography and terrorism to violent crime and economic espionage cases.

Using sophisticated tools and technology, RCFLs analyze evidence from all kinds of electronic devices, including computers, cell phones, video game consoles, and even reel-to-reel tapes.

“Anything that can store data electronically can be analyzed,” said Special Agent Justin Poirier, deputy director of the Chicago RCFL.

RCFL examiners—all certified by the FBI—specialize in locating encrypted, deleted, or damaged file information that could be used as evidence in an investigation.

“Digital evidence has become part of just about every type of investigation,” Poirier said, “because today everybody uses computers and portable electronics such as cell phones.”

The benefit of having a regional forensic facility, he added, is that the FBI can bring its expertise and training directly to where it is needed.

“The idea is to create regional resources,” Poirier explained. “We train the state and local examiners, who make a three-year commitment to the RCFL. When they return to their agencies, they have expertise and access they didn’t have before. And in the process, we build lasting relationships with our regional partners.”

Dziedzic added, “Instead of sending evidence to the FBI Laboratory in Quantico, we can analyze it much faster here in our own backyard.”

Chicago’s RCFL was established in 2003 and consists of five FBI employees and 13 examiners from agencies including the Chicago Police Department, Cook County Sheriff’s Office, and U.S. Customs and Border Protection. It is the only digital forensics lab in Illinois to be accredited by the American Society of Crime Laboratory Directors/Laboratory Accreditation Board.

“Accreditation is the gold standard when it comes to prosecuting cases and testifying in court,” Dziedzic said. “It means that we operate at the highest professional standards.”

“Criminals are using more sophisticated electronic methods to commit crimes,” Poirier said. “This regional approach to digital forensics—pairing the Bureau with local law enforcement to collaborate on cases—is the future for law enforcement. It really works.”

RCFL By the Numbers
The Regional Computer Forensics Laboratory program, a national initiative funded and administered by the FBI, recently released its annual report for fiscal year 2010. Below are a few of the program’s accomplishments. For more information, read the entire report.

- Number of RCFLs nationwide: 16
- Participating agencies: 130, from 17 states
- Examinations conducted: 6,564
- Examiner court testimony: 80
- Computer hard drives processed: 57,067
- Agencies making requests: 722
- Training conducted: 7,403 law enforcement personnel.