2012 annual report - Ashland Police Department

The typical process ofexamination includes firstremoving the computer’shard drive. It is then placed onwhat is called a “write blocker”which prevents anything frombeing changed on the harddrive therefore maintaining theevidence. The hard drive is thenforensically imaged; meaning anexact bit for bit copy of the harddrive is made. The original harddrive is then placed back into theseized computer and securedin the APD Property Room. Theexaminer can now analyze andexamine the write blocked copywhile the original evidence remainsprotected and unchanged. Afterthe examiner has completed theirexamination, a report is completedshowing the results of the analysisand examination.Much of the computerequipment in APD’s ComputerCrimes Lab has been providedthrough partnerships with theUS Secret Service and the FBIRegional Computer Forensics Labin Louisville, KY. This equipmentincludes the above mentionedF.R.E.D. machine, forensic software,laptops for on-scene triage ofevidence, a TD1 forensic duplicator,write blockers, multiple harddrives, thumb drives, card readers,cameras, and tool kits. All of thisequipment is maintained in theComputer Crimes Lab within theCriminal Investigations Section ofthe APD.Computer Forensic Examiners with the APD have extensive trainingin the following area:US Secret Service National Computer Forensic InstituteAccess Data’s five day Forensic BootcampAccessData’s Certified Examiner ProgramAccess Data’s Windows XP ForensicsAccess Data’s Internet ForensicsAccess Data’s Mobile Phone Examiner AnalysisAccess Data’s iOS ForensicsAccess Data’s Windows Registry ForensicsATC-NY MacMarshal Digital Forensics TrainingNational White Collar Crime Center’s Fast Track SeriesDigital Intelligence Computer Forensics with F.R.E.D. courseInternet Crimes Against Children Strategies for Effective Investigationand Prosecution of Child Exploitation OffensesFBI ImageScan Software Training CourseArtist: Elena Sandifer