The FBI’s Orange County Regional Computer Forensic Unit (OCRCFL) is the main source for the forensic processing analysis of digital evidence for law enforcement agencies in Orange County and the surrounding areas.
The cell phone kiosk at OCRCFL allows untrained officers and detectives to quickly process a cell phone, thumb drive or memory card without submitting the evidence for full forensic processing by highly trained OCRCFL digital evidence technicians.
While a full forensic examination is available, it is not always performed. Without running a full forensic examination, the possibility is increased that potentially exculpatory evidence will not be captured and maintained.
There are 3 types of data acquisition for many mobile devices – logical, file system and physical. Apple has a limited logical/file system access. The logical acquisition is the fastest method, but it gives far less data. Police personnel usually use the limited logical examination in order to save time.
When a forensic report shows that there was a “logical acquisition” of data, that is an indication that a limited forensic examination was performed. Additionally, the name of police personnel will appear as the forensic examiner, rather than OCRCFL personnel. If this is the case, it is critical to determine if the correct process was utilized to extract all data and to determine if all possible exculpatory evidence was maintained.
In reviewing discovery evidence, it is imperative to determine the manner in which the cell phone data was downloaded.
To ensure that all items were processed correctly, you must determine whether the items were downloaded by an untrained officer/detective, or whether a full forensic analysis was done by a trained forensic technician.
In a recent sexual assault case (People v. W), officers from the Fullerton Police Department downloaded a complaining witness’s cell phone. After their examination and download, the police department returned the phone to the complaining witness. The witness later discarded the phone and replaced it with a new device.
Due to the failure of officers to fully extract all data from the witness’ phone, pertinent video evidence was not downloaded. Subsequently, the prosecution was forced to dismiss the three-separate life counts as charged and offer the accused an 8-year sentence.