Raidprep
0 likes1,468 views
This document provides guidance for conducting a high tech raid and seizing computer evidence. It outlines the roles and responsibilities of various teams including: a case supervisor to oversee the operation; an interview team; a sketch and photo team to document the scene; a physical search team; a security team; and a technical evidence seizure team to properly handle computer equipment. It emphasizes having the right personnel with the necessary skills and equipment to thoroughly collect electronic evidence while maintaining a chain of custody.
Raidprep
- 1. Conducting the High Tech Raid Planning Resource Collection Practice Review Execution
- 2. Planning S ituation M ission E xecution A venues of approach and escape C ommunication
- 3. Computer Search Warrant Team Even when just one stand-alone computer is seized there is too much to do for just one person to handle. All of the work can be accomplished by two people when necessary but the time on scene is reduced directly in relation to the number of additional trained personnel available.
- 4. Computer Search Warrant Team The Search Warrant Team is a best case scenario. In the real world, you may not have the number of people available to form a complete team and one person may be required perform several functions to compensate.
- 5. Computer Search Warrant Team Know the skills and abilities of your team and use them in the function they are best qualified to perform. Don't be afraid to call for outside expert assistance. Generally speaking, the time required is directly related to the number of people on hand to take care of the crime scene and the quality of the equipment used to backup the systems.
- 6. Computer Search Warrant Team We strongly recommend computer crime investigators have a powerful portable or laptop computer, high capacity SCSI/Parallel tape drive, SCSI cards and necessary cables, investigative software and other equipment at hand which allows for obtaining data or disk images as dictated by the facts of the case.
- 7. Case Supervisor The Case Supervisor should have extensive investigative experience in complex cases. The Case Supervisor handles all media relations, manages and schedules manpower and equipment needs and oversees the case. He may not have to stay at the scene beyond the initial entry and securing of the scene.
- 8. Interview Team This team is comprised of one or more people depending on the number of suspects and persons to be interviewed. Their responsibility is to interview each witnesses/suspect. These team members should have excellent Interview & interrogation skills.
- 9. Sketch & Photo Team This team is comprised of one or more persons. Immediately sketch search scene and assign room letters. Photograph scene and all evidence. They may use any or combination of Polaroid, 35mm, digital and or video cameras. We strongly suggest the use of digital and video cameras.
- 10. Sketch & Photo Team We have had a case actually hinge on a picture of a door lock we were not even concerned about when serving the warrant but the issue of whether or not a lock was on the door or not became critical during the trial. Photograph the entire scene inside and out.
- 11. Note: When using a video camera, turn the sound off (as required by Washington State “all party consent law”) If this is not possible the entire team needs to be aware the scene is being recorded and they should be very careful what they say as it will be recorded for posterity and words lightly spoken could prove to be embarrassing when viewed in court.
- 12. Physical Search Team This team is comprised of one or more persons assigned to search each room. They locate and mark evidence in each room with colored stick on dots for easy location by the Seizure Team. They do not need to be computer experts but should be throughly briefed on the items to search for and they should be thorough.
- 13. Security and Arrest Team Provide physical security of building entrances, persons and evidence as needed. They also handle arrests, transportation and interview of suspects. The size of this team can almost never be too large considering the available man power. This team is often comprised of uniform patrol officers.
- 14. Technical Evidence Seizure and Logging Team This team is comprised of two or three people who seize evidence, enter evidence data into the computer, label the evidence and place it in bags or boxes and label the boxes after evidence is photographed. This team is responsible for taking down a computer after the area is secure and the computer is photographed.
- 15. Sketch & Photo Team This team should include at least one person who is a computer investigator and another who ideally is a computer professional who has received specialized training in the handling and evaluation of evidence. In most instances this technical team will also conduct forensic analysis of the evidence. When a regional, state or Agency lab is not available for such duties. Some agencies simply box up the computer and send the evidence to a lab for analysis.
- 16. Sketch & Photo Team This team should include at least one person who is a computer investigator and another who ideally is a computer professional who has received specialized training in the handling and evaluation of evidence.
- 17. Sketch & Photo Team In most instances this technical team will also conduct forensic analysis of the evidence. When a regional, state or Agency lab is not available for such duties. Some agencies simply box up the computer and send the evidence to a lab for analysis.
- 18. Note:Consider skills in handling and recognition of evidence in picking team members. Use members in context of their skills and abilities If law enforcement is involved in the case they should be local officers as they will be needed in court for "chain" of custody issues and they should know how to handle the electronic and magnetic evidence found.
- 19. The Technical Evidence Seizure and Logging team Decides on appropriate action after discussing special circumstances with the Case Manager. They backup the computer to removable media, run investigative software and shut down the system.
- 20. The Technical Evidence Seizure and Logging team They then mark all cables and safely pack the computer, cables and attachments in preparation for transport. They then insure all evidence is logged and marked by Seizure and Evidence Team.
- 21. The Technical Evidence Seizure and Logging team For investigations involving a large number of computers, the Case Manager may appoint either an investigator or computer expert proficient in both roles to be in charge of all computer seizure teams and to handle all technical questions and problems.