Cops Excel In Computer Forensics Unit

It’s easier to turn a cop into a geek than a geek into a cop.


Detectives in the Arlington unit, as well as other professionals who engage in this type work, must possess an aptitude to understand computer file systems, the bilateral numbering system, and the concepts of magnetic and non-magnetic storage. It is important, as well, that they possess a substantial degree of patience, attention to detail, and some street experience in order to effectively perform their tasks.

Working in a unit of this nature, however, differs from working the street and becomes more of an investigative dynamic. "If you are somebody that likes working the road, you're not going to be on the road anymore chasing bad guys. While in the unit, your days of car chases will be over," says Det. Ordonez. Instead, a detective will become an expert witness for the prosecution and will explain the findings of a case in layman's terms. For professionals, like Ordonez, this work can be rewarding because it brings evidence into a case that, oftentimes, suspects are unaware of, do not believe exists, or think they have been clever enough to outsmart detectives who can discover and obtain evidence from their computers or electronic instruments.

Though detectives are sometimes able to obtain, by consent, the necessary equipment they need for their investigation, there are occasions in which they must obtain a search warrant. In order to do this, detectives must show probable cause to seize the equipment as well as the legal basis to actually gain access to the internal structures. Once they have legal ingress, they can utilize two valuable and commonly used software programs available to law enforcement professionals - Encase and Forensic Tool Kit - both of which are generally accepted by court systems. These programs allow detectives to make a forensic image of the hard drive of a computer without altering any of the data and enable them to search for and locate deleted files or remnants of files in the free space area that Windows cannot find.

Detective Ordonez relates a case that involved a violation of a protective order. The defendant had been arrested for stalking his former girlfriend after she broke off the relationship with him. He was sending her emails in violation of a protective order that emanated from the stalking case. The defendant attempted to commit suicide as a means to take revenge on his former girlfriend. When Detective Ordonez arrived on the scene of a hotel room where the defendant was located, he observed a laptop computer under the chair and noted the Wi-Fi was turned on. Ordonez took a photo of the computer, opened it, and detailed, in writing, his observations about the condition of the computer noting the screensaver was on, that he had wiggled the mouse and there was activity on the computer, marked the time, and indicated what he had actually viewed on the screen. He also pulled the plug on the computer to preserve information.

The victim in this case had changed her phone number. The defendant had created a new name on Yahoo email for himself and used her new phone number - which he was not supposed to be aware of - by transposing the last two numbers of her new phone number. Detective Ordonez discovered that the information preserved on the hard drive had similar wording compared to the emails received by the victim. Interestingly, the defendant claimed he had no internet connectivity in the hotel room and that someone had sent the emails about the victim to him via his Blackberry. He claimed he subsequently forwarded them to the victim. Initially, at the trial, the defendant denied sending three emails to the victim but then, during the trial, suddenly admitted to sending one and pled guilty. Consequently, he was convicted of violation of a protective order.

An advantage to having a unit of this type is that it allows for rapid evidence collection and analysis that facilitates a speedy trial. However, detectives acknowledge there are frustrating aspects to the job. "You spend a lot of time collecting computers and digital images to find the smoking gun isn't there," says Detective Ordonez. There is also a substantial amount of documentation that must be done. Detectives have to take a camera, sketch pad, fill out property forms, conduct examinations, document findings and, overall, engage in a lot of administrative work. Once the case is closed, they still must archive the material to magnetic or digital tape. With digital tape, they are able to back up the information in case it needs to be restored at a later date, but the entire process takes a lot of time.

  • Enhance your experience.

    Thank you for your regular readership of and visits to Officer.com. To continue viewing content on this site, please take a few moments to fill out the form below and register on this website.

    Registration is required to help ensure your access to featured content, and to maintain control of access to content that may be sensitive in nature to law enforcement.