Digital Forensics Unit

Digital Forensics is an expanding field that embraces the exponential growth of new technology. As our lives become more dependent on devices such as smart phones, lap tops, and personal computers the need for specially trained investigators grows. A Digital Forensic Examiner collects evidence from a large variety of sources to assist in solving crimes. Many devices such as a cell phone, surveillance camera recording system, portable music player, or even a tablet computer can be processed to find evidence.

The role of the examiner is to evaluate and interpret data obtained from properly packaged electronic evidence and present it in a way to assist an investigation. The data is extracted in a forensically sound and industry approved manner that creates an exact duplicate without altering the original data. The duplicate is then examined using various software, techniques, and procedures. This method preserves the original evidence and allows for a thorough investigation at the same time.

The Digital Forensics Unit assists in a large variety of investigations. The unit has worked on cases including financial fraud, homicide, robbery, possession of illegal digital material, arson, and stalking. Along with the specialized investigations, the unit also assists in routine cases every St. Louis County Police unit and bureau conducts. Most cases have an element that requires an examiner to process evidence.

Evaluation

The evidence is packaged to be examined in our secure laboratory with the latest technology. All digital evidence is preserved in a forensically sound manner so as not to damage it. If need be, trained Digital Forensic technicians can secure the evidence on scene to ensure proper packaging and procedure.

As part of the exam, the evidence is carefully photographed and documented. The unit performs a full examination which includes pulling as much data from the device as possible. This is done with various computer hardware and software that copy and preserve the information in its' original state. After the data is extracted the examiner will carefully comb through all of the information obtained and document it. Due to the increasing size of the internal memory and additional memory sources (SD Cards, et al.) this can sometimes be quite a bit of data. Many of the methods can even recover previously deleted or hidden data as well.

The information is analyzed and organized into specific reports with a clear explanation of every step taken to obtain it. Any notable information is pointed out and highlighted in the findings section of the report. Every report has clear contact information and staff is available to assist with any technical questions