Approximately two years ago, the Indiana State Police instituted a unique program in which examiners conduct on scene computer forensics. The goal of the Computer Forensics Field Triage program is to utilize departmental resources efficiently to improve cyber crime investigations by conducting on scene computer examinations in a forensically sound manner. The program was an immediate success. Investigators found that conducting examinations on scene was far superior to conducting examinations in a laboratory setting. Specific circumstances sometimes dictate that an on scene examination is the only viable alternative…Police agencies historically have unplugged computers found during a search and transported them to a laboratory for examination. If the computer is shut down incorrectly or the plug pulled on a running computer all of the data in the volatile memory will be lost. Often, the volatile memory contains the best, and sometimes only, evidence.
The on scene examinations are conducted in a mobile forensics laboratory, which is a converted recreational vehicle. The vehicle, which was toured today by local media, has room for three examiners and is equipped with a server, generator, equipment to review video media and a temporary evidence storage area. The vehicle has been at investigative scenes ranging from homicides to Hurricane Katrina fraud.
It is not practical to have a forensic examiner on scene for every investigation. Therefore, the Indiana State Police implemented a tiered approach for on scene examinations, training selected detectives as “first responders” to review digital storage media and hard drives.
The Indiana State Police collaborated with the National White Collar Crime Center, Purdue University and the United States Attorney’s Office for the Southern District of Indiana to establish training standards and operational procedures.
This program enabled the Indiana State Police to be an investigative leader. In May 2007, detectives used on scene computer forensics at the residences of nine suspected child pornographers during a four day period with a 100% success rate in locating evidence, obtaining admissions and creating a positive public education impact.
In August, the International Association of Chiefs of Police announced that the Indiana State Police had won the 4th Annual IACP-iXP Excellence in Technology Award for 2007. The Indiana State Police was recognized with this prestigious award for its “Computer Forensic Field Triage” initiative.
Department members will be accepting the award at a public ceremony at the International Chiefs of Police annual conference in New Orleans this October.
Source: Indiana State Police
