Packaging and Shipping Evidence

Content - Examinations can determine what type of data files are in a computer.

Comparison - Examinations can compare data files to known documents and data files.

Transaction - Examinations can determine the time and sequence that data files were created.

Extraction - Data files can be extracted from the computer.

Deleted Data Files - Deleted data files can be recovered from the computer.

Format Conversion - Data files can be converted from one format to another.

Keyword Searching - Data files can be searched for a word or phrase and all occurrences recorded.

Passwords - Passwords can be recovered and decrypted.

Limited Source Code - Source code can be analyzed and compared.

Storage Media - Storage media used with stand-alone word processors (typewriters) can be examined.

Requesting a Search or Field Examination

Submit requests for a search or field examination at least one week in advance.

Obtain as much of the following information as possible prior to submitting a request:

  • Determine the type of computers and operating systems.
  • If applicable, determine the type of network software, the location of the network servers, and the number of computers on the network.
  • Determine if encryption and/or password protection is used.
  • Specify if a seizure of computers and media or an on-site examination is required.

Submitting Computer Evidence

Questions concerning computer evidence should be directed to 202-324-9307. Follow the Evidence Submission directions including Requesting Evidence Examinations and Packaging and Shipping Evidence.

For most examinations, submit only the central processing units and the internal and external storage media. Use a sturdy cardboard container when shipping computer components. If possible, use the original packing case with the fitted padding. Use large, plastic bubble wrap or foam rubber pads as packing. Do not use loose StyrofoamJ because it lodges inside computers and/or components and creates static charges that can cause data loss or damage to circuit boards. Seal the container with a strong packing tape.

Pack and ship central processing units in the upright position. Label the outside container THIS END UP. Disks, cartridges, tapes, and hard drives should be packed to avoid movement during shipping. Label the outer container FRAGILE, SENSITIVE ELECTRONIC EQUIPMENT and KEEP AWAY FROM MAGNETS OR MAGNETIC FIELDS.

Personal Digital Assistants, Interception of Communication Devices, and Electronic Devices Examinations

PERSONAL DIGITAL ASSISTANTS
Examinations of personal digital assistants (PDA) provide printouts of user-entered information. In some cases, it is necessary to disassemble the PDAs during examination.

INTERCEPTION OF COMMUNICATION DEVICES
Interception of communication (IOC) devices are used to unlawfully intercept oral or wire communications. IOC devices consist of radio frequency transmitters and receivers. IOC examinations are conducted to identify operating characteristics. In some cases, it is necessary to disassemble the IOC devices during examination.

ELECTRONIC DEVICES
Examinations are conducted on devices containing electronic circuitry such as cellular telephones, pagers, bomb detonators, and stun guns. The examinations can identify operating characteristics and modifications. In some cases, it is necessary to disassemble the devices during examination.

fbi_pda

Submitting Personal Digital Assistants, Interception of Communication Devices, and Electronic Devices Evidence

Questions concerning evidence should be directed to 703-632-6191 or 703-632-6200. Follow the Evidence Submission directions including Requesting Evidence Examinations and Packaging and Shipping Evidence.

Label the outer container FRAGILE, SENSITIVE ELECTRONIC EQUIPMENT and KEEP AWAY FROM MAGNETS OR MAGNETIC FIELDS.

Address the outer container as follows:

FBI Engineering Research Facility
Attention: Forensic Program
Building 27958A
Quantico VA 22135