Advances in digital forensics technology have made it possible for an officer with minimal training to retrieve digital evidence and utilize it for investigative purposes. Today, officers can gain intelligence data off a device in hours instead of waiting weeks, months or years for the lab to get to it, according to Eskridge.
The first step in the triage process—no matter if it’s a PC, a laptop or a cell phone, is to isolate the device or in other words take it off the network. That might mean unplugging the modem, disabling the wireless or blocking access to the cell phone network. “This prevents suspects from going online and wiping out their phones or computers wirelessly,” says Eskridge. “Then no one is going to recover data from it because the data is gone.”
Depending on the details of the case, officers can then decide to forensically examine digital evidence at the crime scene, at the department forensics lab, or send it out to the state lab for processing.
When the Pasco County Sheriff’s Office originally designed its lab, officials focused on bringing all evidence in to the department lab. Soon they realized they also needed to forensically analyze digital devices on-scene. “We once had an investigation where we had close to 60 computers at the scene, but according to the warrant, none of the computers could leave the business,” Pepenella says. “We had to process them at the scene, and because of the equipment we had, we were able to do it.”
While Pasco County performs most processing back at its home base, when cases warrant immediate analysis they do it in the field. “Ultimately though we prefer to bring everything back to the lab because we can process it in a more controlled environment,” he adds.
Sometimes there is simply no choice but to send the digital device to a lab, according to Pepenella. He explains at times officers cannot bypass a cell phone or computer password because a JTAG has been used to block access. “These devices have to be sent out because a forensics examiner must take them apart to recover data,” he explains.
The primary advantage of digital triage is improved access to forensic evidence. “Ninety percent of the digital media recovered is never looked at because it’s no longer needed by the time the lab gets to it,” Eskridge says.
Consider this example: Authorities confiscate a computer in a fraud case and send it to the state RCFL. In the 13 months it takes for state officials to examine that computer, the suspect may have already plead guilty to two charges of fraud and sentenced to 90 days in the county jail and two years of probation. Eskridge explains, “If I’m a bad guy, I’ll plead guilty right away, knowing that if I let the case drag on and authorities actually look at my computer, I’ll be facing 100 counts of fraud and state prison. In this example, when the lab finally gets to that computer a year later, the detective tells them the case was already plead out, and state officials never look at the hard drive. Now imagine that same case if they had looked at that drive immediately.”
Triaging cell phones in particular can have an immediate impact. “Cell phones are much easier to triage than a computer,” he says. “We have what we call the 85 percent rule. Eighty-five percent of the cell phones you come across could be lawfully searched when officers seized the phone. Officers could get the exact same data in five minutes that they would have received two weeks to a month later from the crime lab.”
The result is faster turnaround. Pasco County’s official turnaround is 30 days for cell phones and six months for computers. “But realistically we’re looking at about a month for computers and a week for cell phones,” Pepenella says. “And sometimes, depending on the case, we process them right away.”
Faster turnaround boosts law enforcement’s crime solving capabilities. “We had one case where detectives had an accusation that involved sexual battery, and with the information [the investigator] got off the cell phone, he was able to conclude his case in a matter of hours,” Pepenella recalls.
If a full-blown computer forensics lab that can handle 95 percent of all digital investigations is what a department desires, an agency requires the following technology: