The GHRCFL can help with search warrant preparation as it applies to computer evidence, by advising on computer related language, which may be included in the affidavit.
Requests for this type of assistance should be made a minimum of 48 hours in advance by filling out a Service Request form. However, the GHRCFL understands that there will be times when an agency will unexpectedly discover computer evidence that they are unprepared to manage. Under these circumstances, the advance notice requirement is waived, but for scheduling purposes, the more lead-time given to the GHRCFL, the better. Once the search request is evaluated by the GHRCFL, the Operations Manager will assign it to an examiner who will then contact the requesting agency.
Examinations are typically conducted on copies of the original evidence because of the possibility that the data may be contaminated. Therefore, GHRCFL Examiners, depending on the circumstances, will either duplicate the media (or copy the information) on-site, or they will bring the electronic equipment to the laboratory where they will duplicate the media and then perform the examination.
Computer Forensics Examiners are scientists. As scientists, their job is to conduct a thorough and objective examination of a computer and/or computer related evidence to convert it from a digital format into something that the investigator can view. It is not the examiner's responsibility to analyze the data for its meaning or significance to the investigation. This impartiality and objectivity lends credibility to both their findings and subsequent testimony.
As records are recovered from seized computer evidence, the prosecutor is likely to use the Examiner to introduce the computer or computer related evidence into court. As an expert witness, the Examiner can explain, under oath, about how they conducted the examination and what they discovered as a result.