Digital evidence comes in all shapes and sizes: pallets full of computers, a hard drive with an AK-47 bullet hole in it, audio tapes fished out of the ocean, mangled floppies, garbled 911 calls. Whenever U.S. government agencies investigating a crime or a cybercrime has digital evidence that's too difficult to analyze, they send it to the Department of Defense computer forensics lab. . . .
Digital evidence comes in all shapes and sizes: pallets full of computers, a hard drive with an AK-47 bullet hole in it, audio tapes fished out of the ocean, mangled floppies, garbled 911 calls.

Whenever U.S. government agencies investigating a crime or a cybercrime has digital evidence that's too difficult to analyze, they send it to the Department of Defense computer forensics lab.

The evidence can arrive in a military vehicle, via FedEx or through the U.S. Postal Service. However it gets there, it's accepted at the loading dock of an unmarked commercial building on the outskirts of Baltimore.

It's then logged and sent to an evidence custodian, who inventories, tags and stores it in a locked cage.

Network World was invited into the Defense Computer Forensics Lab (DCFL) for an inside look at how computer investigators at the cutting edge are using digital evidence to help solve crimes.

The purpose of the lab is to analyze evidence gathered at crime scenes involving the military. Whatever crimes occur in the civilian world, you also see in the military. It could be homicide, child pornography, identity theft, counterfeiting, misconduct, terrorism, espionage, contractor fraud or misuse of government property.

With these crimes, there's often digital evidence in cell phones, pagers, PDAs, geo-mapping systems, digital cameras, cockpit recording systems and anything else with flash memory or ROM.

"We estimate that 95% of criminals leave digital evidence at the scene," says Donald Flynn, attorney adviser for the Defense Department Cyber Crime Center, which houses the DCFL.

That evidence must be able to stand up in court, particularly now that judges and attorneys are becoming savvy enough to start asking questions about the integrity of digital evidence. The DCFL addresses this through rigorous training and advanced tools such as certified, high-capacity extraction and imaging processes and tools.
Inside the lab

My tour guide at the high-security lab pushed a button at the double-door entryway into the lab that triggered blue ceiling lights, which blinked incessantly to alert technicians that unclassified visitors were on the premises.

The lab includes your standard office cubicles, but every cube is outfitted with state-of-the-art processors, multi-system server stacks and 42-inch flat-screen monitors.

"Some of the evidence comes in on pallets - cases full of servers, CPUs, RAID disk arrays, floppy diskettes, Palm Pilots, digital cameras," says special agent Bob Renko, director of operations for the lab. "We've even gotten evidence in buckets of water - for example, video tapes recovered from jets crashing into the sea during training exercises."