Q. In brief, what do I need to do to submit evidence for review by the HARCFL?
Effective February 1, 2011 Non-Participating agencies should be prepared to submit a letter from the Chief Executive of the agency (Chief, Sheriff, etc) at the time of the evidence submission. A link to the required verbiage is under the Operations tab and can be copied to agency letterhead. Q: What type of cases do you accept? Q: What type of cases do you NOT accept? Q: Are there any guidelines for submitting evidence?
The media examined by the HARCFL has historically doubled every year. To help focus our limited resources on the media most likely to contain evidence, effective February 1, 2011 all cases involving child pornography which exceed 5 evidence items (computers or hard drives) or 3 TB’s must be previewed using forensic tools, with software or hardware writeblocking, such as Imagescan, Knoppix, FastScan or other forensically sound tools. Q: Why is the HARCFL making this policy change?
Case Submission FAQs
A: HARCFL customers fall into either the participating agency group or the non-participating group. Depending on which group you are in will determine how you will submit evidence, as follows:
—Participating Agencies - Should automatically submit an online Request for Service form and forward their evidence to the laboratory. The list of participating agencies can be found here.
—Non-Participating Agencies - Should submit an online Request for Service form and retain their evidence until otherwise instructed by the laboratory.
A: The HARCL conducts forensic examinations of digital media, cell phones and video involving threats to National Security and Felony offenses. The service area is the state of Kansas and Western Missouri (counties served by the US Attorney’s office in Kansas City). All case submission requests are reviewed on a case-by-case basis by the Director, or designee, using objective criteria.
A: Some examples of cases the HARCFL does not accept include misdemeanor offenses, officer misconduct cases (absent criminal offense), theft/fraud with low losses. The HARCFL does not conduct examinations on civil cases, adjudicated cases or death investigations where foul play is not suspected. Cases acceptance is partially based on intake volumes and maintaining reasonable turn-around times.
A: Yes, but as a general rule, investigators should be mindful of the type of digital evidence they submit to the HARCFL for review. For example, unless it’s a copyright investigation, including items such as commercially produced music CDs or movie DVDs will have no bearing on the investigation. However, by submitting these types of items, the laboratory staff must enter them as evidence – and that takes time that could be better spent conducting the examination. Investigators should use their good judgment when gathering digital evidence – only submitting those items that they think require examination by the HARCFL staff.
HARCFL customers are advised to follow these simple guidelines:
• Central Processing Unit (CPUs) – Submit the actual CPU – not peripheral items such as monitors, keyboards, mice, etc.
• Laptops – Submit the laptop along with the power cord.
• CDs and DVDs - Preview all CDs and DVD's in a ROM (read-only drive) prior to submission. Then submit only those items containing suspect files. DO NOT submit unreviewed discs, without prior approval from the HARCFL staff. Again, commercially produced music CDs and movie DVDs are more than likely not going to have an impact on the investigation. Investigators should sort through the evidence being gathered to ensure that these items are not part of the submission to the HARCFL.
• Floppy Disks – Floppy disks may be previewed by ensuring the write protection tab is in the open position to prevent altering the contents. Please submit only those floppy discs that you have determined are relevant to your investigation.
• Cell phones/ GPSs/ PDAs - Include data cables, chargers, and docking stations.
Q: Should I preview my evidence prior to submission?
A: Since the HARCFL opened in 2003, case submissions have increased by 33% each year. To keep pace with the growing demand for its services, the HARCFL's Local Executive Board (LEB), which includes law enforcement officials from 19 agencies in Missouri and Kansas, began exploring different ways to continue providing the same high quality services in a timely manner. After studying this situation for eight months, the LEB determined that the most effective way to meet this goal was to better utilize available technology (CAIR; online service requests forms) and to prioritize the requests for service from non-participating agencies using an objective set of criteria.
Q: How will this change affect the HARCFL’s participating agencies?
A: The HARCFL will continue to accept all cases from its participating agencies (those departments that detail personnel to the laboratory or provide a significant annual financial contribution). The participating agencies are required to submit an online Request for Service form, and should forward their digital evidence to the laboratory with a copy of the request. The related legal authority and pertinent investigative reports may be submitted to the laboratory either electronically with the initial Request for Service, or by hard copy with the evidence.
Q: How will this change impact non-participating agencies?
A: Due to the heavy demands being placed on the limited resources of the HARCFL, the laboratory will prioritize cases submitted from non-participating agencies and will accept as many cases as possible which meet objective criteria and can be completed in a reasonable period. Non-participating agencies should submit the online Request for Service form, but retain their digital evidence until instructed otherwise by the laboratory. Upon being contacted by the laboratory, digital evidence may be forwarded to the HARCFL with a copy of the request. The related legal authority and pertinent investigative reports may be submitted to the laboratory either electronically with the initial Request for Service, or by hard copy with the evidence.
Q: What happens if a non-participating agency completes the online form and sends the digital evidence to the HARCFL for examination? Will they accept the evidence while the request is under review?
A: A non-participating agency should submit evidence to the HARCFL only after being contacted by the laboratory staff. Evidence submitted prior to the case being accepted by the laboratory will be immediately returned.
Q: What if my request is considered a low priority – then what?
A: The HARCFL will accept all cases from its participating agencies. However, for non-participating agencies, the laboratory will prioritize the request and contact the agency when the staff is ready to begin the examination. For those requests that receive a low priority, the HARCFL will notify the requestor via e-mail that the case cannot be accepted at this time, providing the submitter with the option of taking their evidence to another facility.
Q: Generally, how long does it take for the HARCFL staff to notify customers from non-participating agencies of the status of a request?
A: Non-participating agencies can expect a response from the lab near the end of each month.
Q: What does the CAIR tool offer its users?
A: The CAIR tool can assist investigators in advancing their cases, setting leads, establishing probable cause for search and/or arrest warrants, testifying at preliminary hearings, etc. The HARCFL is the first digital forensic laboratory to allow state and local investigators to utilize this program at their desks via a secure law enforcement Internet system. This has proven to be a great time saver both for the laboratory and its customers, and is extremely user-friendly.
Q: What does the CAIR training course cover?
A: This 1-day course is for all RCFL clients and is designed for all computer skill sets. Under the CAIR program, digital evidence submitted to the laboratory is imaged, processed utilizing special software and then made available to investigators to review images, e-mail messages and documents, and "bookmark" such for inclusion in a report for future reference.
Q: Is there a cost associated with this course?
A: No, the training is free of charge to law enforcement. Students can register online for the class by visiting the HARCFL's training section on its Web page.
Q: What are self-service cell phone, loose media and video kiosks? How does that service work?
A: In those situations where investigators don’t require a complete forensic examination, but are still interested in accessing data extracted from a cell phone, loose digital media or still images from a DVD, the laboratory offers self-service kiosks with equipment, supplies and immediate expert assistance.
These stations are available to any agency at any time during normal HARCFL business hours. Evidence derived from these devices can be taken that day. Self-service features include—
• Cell phone extraction device
• Loose media (CD/DVD/BD, jump drives, flash cards and SATA hard drives)
• CD/DVD review and duplication
• Digital extraction and screen capture to produce still images (photographs)
• Preview of media for illicit images or pornography.
Q: Where are these kiosks located?
A: They are located in the HARCFL's administrative area and are accessible to all law enforcement officers during normal business hours.
Q: Do we have to make an appointment to use the kiosks?
A: Appointments are not required. The equipment is designed to be used by investigators at their convenience, with most reviews being completed within a matter of a few minutes.
Q: Who can I contact for more information?
A: For additional information, contact the HARCFL Acting Deputy Director, Todd Taylor at (816) 584-4316 or at firstname.lastname@example.org.
Q. In brief, what do I need to do to submit evidence for review by the HARCFL?
Effective February 1, 2011 Non-Participating agencies should be prepared to submit a letter from the Chief Executive of the agency (Chief, Sheriff, etc) at the time of the evidence submission. A link to the required verbiage is under the Operations tab and can be copied to agency letterhead.
Q: What type of cases do you accept?
Q: What type of cases do you NOT accept?
Q: Are there any guidelines for submitting evidence?
The media examined by the HARCFL has historically doubled every year. To help focus our limited resources on the media most likely to contain evidence, effective February 1, 2011 all cases involving child pornography which exceed 5 evidence items (computers or hard drives) or 3 TB’s must be previewed using forensic tools, with software or hardware writeblocking, such as Imagescan, Knoppix, FastScan or other forensically sound tools.
Q: Why is the HARCFL making this policy change?