Powerful home computers. Smaller, more capable digital devices. While means for law-abiding citizens, these technological advancements are also being exploited for cybercrime. Law enforcement agencies around the nation are increasing their number of computer forensic examiners to support criminal investigations involving computers. A little more than one year ago, on March 12, 2001, the North Texas Regional Computer Forensics Laboratory (NTRCFL) opened to meet local investigative needs. The NTRCFL combines resources from FBI Dallas, the Laboratory Division at FBI Headquarters in Washington, D.C., and other federal, state, and local agencies to investigate cybercrime. Examiners are from both federal and local agencies*. Cases of suspected cybercrime are submitted for assistance to the NTRCFL by regional agencies. The primary mission of the NTRCFL is to ensure that there are sufficient well-trained and well-equipped computer forensics examiners to support local, state, and federal investigations and prosecutions in the north Texas Region. This region, known as the Dallas Metroplex, is the greater Dallas-Forth Worth area. NTRCFL examiners assist in the seizure and collection of digital evidence at a crime scene, conduct impartial analysis of submitted computer evidence, and testify when necessary. The NTRCFL also provides training to agencies and departments in basic guidelines and proper techniques for seizing, storing, and analyzing computer evidence. Improper handling of computer evidence can compromise an investigation. The NTRCFL quickly became a valuable resource for agencies in the region to battle cybercrime. From September 2000 through September 2001, over half the cases submitted were by local agencies including police departments. The most common types of crimes submitted to the Lab were child pornography, computer intrusion, and financial fraud. During that same time, Lab examiners provided training to more than 400 officers. There is a pressing need for computer forensics examiners around the nation because of the complexity of tools used by suspects, including different operating systems, varying hard drive sizes, and technologies like personal digital assistants. A single floppy diskette holds roughly 500 pages of documents. A single compact disc can hold approximately 450 floppy diskettes. A 30-gigabyte hard drive can hold roughly 50 times a compact disc. All information must be reviewed for potential relevancy to a case. Recent Examples of the NTRCFL at Work In a second case, a Texas police department requested NTRCFL assistance in examining two desktop computers and a laptop computer for evidence of aggravated sexual assault of a child. Investigators were also searching for information that would show that the mother had prior knowledge of the abuse, as alleged by the 14-year-old victim.Photographs of the victim were found on the stepfather's computer, as well as an e-mail journal between himself and his stepdaughter that detailed some of the assaults. There were over 8,000 stored e-mails on this computer system alone. The mother's computer was also examined and it was determined that she had deleted a significant number of e-mails, several hundred of which were still recoverable. One of the recovered e-mails detailed the mother's prior knowledge of the assaults. This e-mail was a blackmail letter to the stepfather which clearly stated terms and conditions of a divorce and financial support, which she expected from the stepfather, or she would turn him over to police. This e-mail proved invaluable to the local investigators during interview of the mother. A third case involved a 15-year-old female student who accused a teacher of sexual assault. During the investigation, detectives were concerned that there may have been other victims, but all of the potential victims denied any involvement with the teacher. The mother of one of the victims consented to a search of a computer used by her daughter. Through recovered deleted e-mails, the detectives learned that there were other victims and once these e-mails were brought to the victims' attention, they admitted that the suspect had victimized them. * The member agencies of the North Texas Regional Computer Forensics Laboratory are: police departments, including Allen, Carrollton, Dallas, Farmers Branch, Garland, Grand Prairie, Plano, and Richardson; the Texas Internet Bureau (Texas Attorney General's Office); and the FBI. Related Link: | FBI Dallas | |