4 hr. Electronic Evidence Seizure-Dixon

 This Homeland Security Grant funded class requires a minimum of 15 students

This course meets the mandates for Lead Homicide Investigator, Law Updates, Civil Rights, Constitutional and proper use of law enforcement authority

Course Content: This 4-hour course is designed to introduce officers to computer evidence seizure procedures, Computer Crimes and Processing of Computer Crime Scenes.  The course will also address Legal Principals regarding Computer Crimes, Digital Investigative Units, Computer Investigations and Cyber Terrorism. Areas addressed in this course include evaluating computer evidence, correlating disparate data in forming conclusions, network considerations and report writing:

• Describe applicable laws and basic legal reasoning related to computer evidence seizure.
• Describe crime scene management considerations with digital media.
• Describe the procedures and expectations for working at a crime scene following the “Best Practices” model from the United States Secret Service and the Nation Institute of Justice (NIJ).  NIJ provides objective, independent, evidence-based knowledge and tools to enhance the administration of justice and public safety.
• Describe the methods/procedures required with the securing, packaging, & transport of electronic media.
• Describe methods for searching for digital evidence with software such as ILOOK, FTK, Encase, etc.
• Describe methods of collecting and preserving digital evidence with the “Best Practices” model from the United States Secret Service and the Nation Institute of Justice (NIJ).
• Describe analytical thinking techniques related to crime scenes.
• Describe digital evidence and its forms.
• Describe the locations of computer forensic evidence storage (hardware/media, etc). Locate the hard drive in a central processing unit (CPU).
• Describe the “chain of custody” as it relates to the proper collection and documentation of digital evidence.

This workshop is the short version of the “Basic Computer Networking & Internet Topics for First Responders II”.

The law enforcement and private security response to electronic evidence seizure requires that officers, investigators, probation officers, forensic examiners, and managers all play a role. This information serves as a guide for the first responder.

• A first responder may be responsible for the recognition, collection, preservation, transportation, and/or storage of electronic evidence. This is common in most law enforcement communities. Officers and security agents may encounter electronic devices during their day-to-day duties.
• Investigators may direct the collection of electronic evidence or may perform the collection themselves.
• Forensic examiners can provide assistance at crime scenes and will perform examinations on the evidence.
• Managers have the responsibility of ensuring that personnel under their direction are adequately trained and equipped to properly handle electronic evidence.

Each responder must understand the fragile nature of electronic evidence and the principles and procedures associated with its collection and preservation. Actions that have the potential to alter, damage, or destroy original evidence may be closely scrutinized by the courts. We must also identify qualified agencies, examiners and laboratories that can correctly process our evidence.

A computer is not required for this training. It is highly recommended you bring your own computer if you want to follow along during class. The instructor has approximately 15 laptop computers for students to use/share.

This project is supported by Homeland Security funds, awarded by the Illinois Terrorism Task Force through the Illinois Law Enforcement Training and Standards Board Executive Institute.

Allowable Attendees: Law enforcement, Fire Service, EMS, Public Health, Behavioral Health, Agriculture, Information Technology, Emergency Managers, Transportation, Elected Officials, Public Works, Other Public Safety Responders / MTU1 members will be given priority attendance.