Frequently Asked Questions

How do I request field assistance or Lab work?

For field assistance or lab work you must complete an RCFL Service Request form. If you have multiple search sites, you must complete an individual request for each site. Similarly, a separate request is needed for lab work from each site. You may send your requests by mail or facsimile.

When requesting assistance, please use the GHRCFL Service Request Form.

Who can submit digital evidence to the RCFL?

Any local, state or federal law enforcement agency in the GHRCFL Service Area may submit digital evidence for examination.

What type of cases will the RCFL accept?

The RCFL will accept any criminal casework involving a computer or digital evidence. The details of your case will remain confidential. All Examiners are bound by a non-disclosure agreement and maintain a Top Secret Security Clearance. All examiners are Certified FBI CART (Computer Analysis Response Team) Field Examiners

Will the RCFL take custody of the digital evidence from the search site?

No, RCFL Examiners will assist with shutting down computers, disassembly of peripherals and packaging of pertinent digital evidence. It is incumbent upon each agency to collect and inventory all digital evidence from the scene in accordance with their individual agency guidelines.

How much advance notice is required for RCFL assistance with field searches?

We recommend at least 48 hours notice, however, Examiners are available to respond 24/7 for emergencies.

Will the RCFL assist me with search warrant language for digital evidence?

Yes, Examiners will provide assistance with proper language to ensure digital evidence is properly covered within your search warrant.

Can the RCFL crack passwords?

Yes, the RCFL has advanced software and hardware tools, which can be successful in cracking passwords and encryption.

If I find a computer running, will it really hurt anything if I look around at some of the files?

Yes, it can jeopardize your case. Unlike traditional evidence, digital evidence can be destroyed if not handled properly. Accessing computer files can lead to deleted files, accidental file encryption, activation of destructive programs, and allegations of evidence tampering.