Orange County RCFL Frequently Asked Questions
Please select a FAQ category:
Case Submission
Click a question to unhide/hide its answer.
1. How do I submit a case to the OCRCFL for examination?
As we have just opened, we are asking that our customers from "Participating Agencies" to come down to the OCRCFL and submit their service request. This will give you a chance to see the lab and learn about or new procedures. It will give us a chance to make sure we work through any "bugs" in our new customer input program and provide you the highest level of customer service possible.
Our lab is located in the City of Orange:
3800 West Chapman Avenue,
Suite 800
Orange, CA 92868
GPS Coordinates:
XXXXXXXXXXXXXXX
The OCRCFL phone number is:
714.385.6100
OCRCFL Laboratory Hours:
Monday through Friday – 8:00 am to 4:00 pm
Closed on all Federal Holidays
The OCRCFL will accept all cases from the OCRCFL Participating Agencies. If you are from a Participating Agency and want to submit a case to the OCRCFL for forensic analysis, you should bring your digital media and your legal authority to the OCRCFL during Laboratory business hours, Monday through Friday 8:00 am to 4:00 pm. To avoid a wait upon arriving at the laboratory, it is recommended that you call ahead of time to ensure there are not other customers in front of you.
Cases from Non-Participating Agencies will have to be pre-approved by Laboratory management before acceptance into the OCRCFL. If you wish to submit a case and are from a Non-Participating Agency, please e-mail your Request for Service to ocsr@rcfl.gov. We will review your Request for Service submission and contact within 2 business days to inform you if we can or cannot assist on your request.
If the OCRCFL is able to accept your Request for Service submission, and you are from a Non-Participating Agency, we will contact you with a case number for your request. You will then be required to provide the following items to have your case submitted to the OCRCFL for forensic examination:
- Legal Authority; and
- Non-Participating Agency Chief Request Letter; and
- Your Digital Media
2. What do I need to do to submit evidence for review by the OCRCFL?
As noted above, OCRCFL customers fall into one of two categories: Participating Agencies (PA) or Non-Participating Agencies (NPA).
Depending on whether you are a Participating Agency or a Non-Participating Agency will determine how you will submit evidence to the OCRCFL, as follows:
- Participating Agencies should submit an online OCRCFL "Request for Service" form and forward your evidence and legal authority to the Laboratory for assistance.
- Once having obtained Laboratory approval to submit a case, Non-Participating Agencies representatives should bring their digital media to the Laboratory as well as the appropriatde legal authority and a letter from their Agency head requesting assistance.
PLEASE NOTE - effective February 1, 2011 Non-Participating Agencies will be required to submit a Non-Participating Agency Assistance Letter from the Chief Executive of their agency (Chief, Sheriff, etc) at the time of the evidence submission requesting OCRCFL assistance.
3. Why does the OCRCFL differentiate Participating Agencies from Non-Participating Agencies?
The OCRCFL consists of forensic examiners from the 10 separate local, state and federal agencies. These agencies have all committed at least one, if not more, full time "bodies" to the Laboratory. In fact, without these forensic examiners detailed to the OCRCFL, the OCRCFL could not exist. Many of the Participating Agencies sending full-time personnel to the OCRCFL no longer have in-house computer forensic laboratories and rely on the OCRCFL first and foremost for all of their computer forensic needs.
As such, the OCRCFL has to ensure that the OCRCFL Participating Agencies have complete access to the full service capabilities of the OCRCFL.
Unfortunately, with over 250 law enforcement agencies in the OCRCFL's jurisdictional limits, it would be impossible to provide all of these agencies with the same level of commitment on every examination request as we would do for the Participating Agencies that help staff the OCRCFL.
Therefore, there will have to be some limits to what services Non-Participating Agencies will be able to receive should the OCRCFL agree to assist on a forensic or search request.
4. What type of cases do you accept?
The OCRCL conducts forensic examinations of most types of digital media devices, including cell phones, in all cases involving threats to National Security and most types of criminal offenses.
The OCRCFL service area contains approximately 250 law enforcement agencies and mirrors the coverage area of the federal Central District of California, including Orange County, Los Angeles County, Riverside County, San Bernardino County, Santa Barbara County, Ventura County and San Luis Obispo County.
5. What type of cases do you NOT accept?
Some examples of cases the OCRCFL may not accept include misdemeanor offenses, officer misconduct cases (absent criminal offense) and theft/fraud with low losses.
The OCRCFL does not conduct examinations on civil cases, adjudicated cases or death investigations where foul play is not suspected.
The OCRCFL case acceptance policy is also partially based on intake volumes and maintaining reasonable turn-around times.
6. Are there any guidelines for submitting digital evidence?
Yes, but as a general rule, investigators should be mindful of the type of digital evidence they submit to the OCRCFL for review.
For example, unless it's a copyright investigation, including items such as commercially produced music CDs or movie DVDs will have no bearing on the investigation. However, by submitting these types of items, the laboratory staff must enter them as evidence – and that takes time that could be better spent conducting the examination.
OCRCFL customers are advised to follow these simple guidelines:
- Central Processing Unit (CPUs): Submit the actual CPU – not peripheral items such as monitors, keyboards, mice, etc.
- Laptops: Submit the laptop along with the power cord. Try and bring the laptop in with its original case if it is available.
- CDs and DVDs: Generally, the OCRCFL requires that the submitter previews all CDs and DVD's in a ROM (read-only drive) prior to submission. This can be done at the OCRCFL. Then submit only those CDs or DVDs containing possible suspect files. Please do not submit un-reviewed discs, without prior approval from the OCRCFL.
- Floppy Disks: Floppy disks may be previewed by ensuring the write protection tab is in the open position to prevent altering the contents. Please submit only those floppy discs that you have determined are relevant to your investigation.
- Cell phones / GPSs / PDAs: Include data cables, chargers, and docking stations.
No. A Non-Participating Agency should submit evidence to the OCRCFL only after being contacted by Laboratory personnel indicating the OCRCFL will accept the Request for Service. Evidence submitted prior to the case being accepted by the Laboratory will be immediately returned.
8. What if my request is considered a low priority?
All cases submitted to the OCRCFL, whether from Participating Agencies or Non-Participating Agencies, will have to be prioritized based on the OCRCFL Case Prioritization System. Once your case is accepted, the Laboratory will prioritize your request and contact you when the case is assigned out to a forensic examiner for assistance.
By definition, some requests will be lower priority requests than others. For those requests that receive a low priority, the OCRCFL will notify you with as realistic a timeline as possible as to when your case will be completed.
You can expect a response from the Laboratory within two (2) working days of submission on the status of their request. Additionally, once a case is submitted for forensic examination, you should receive an e-mail from your assigned forensic examiner with appropriate contact information.
If you have not received an e-mail with the name of your assigned examiner within these two working days, please contact the Laboratory immediately so we can provide you that information and ensure that you know who is working your case.
10. Who can I contact for more information?
The OCRCFL will have a "Duty Examiner" on duty every day the Laboratory is open for business. If you have any technical questions about digital media as it relates to your case, or if you want to check on the Kiosk usage, please call the Laboratory's main number and ask for the Duty Examiner.
For additional information about case submissions, please contact OCRCFL Deputy Director – Operations, Baden Gardner at baden.gardner@da.ocgov.com.
Cell Phone Kiosk
Click a question to unhide/hide its answer.
1. What are the "self-service" cell phone and loose media kiosks? How does that service work?
In those situations where case agents and investigators don't require more complex forensic examination assistance, but are still interested in accessing data extracted from a cell phone or piece of loose digital media, the Laboratory offers "self-service kiosks" with equipment, supplies and immediate expert assistance.
These stations are available to any agency at any time during normal OCRCFL business hours. Evidence derived from these devices can be taken that day. Self-service features include:
- Cell phone extraction device
- Loose media (CD/DVD/BD, jump drives, flash cards, etc)
- CD/DVD review and duplication
- Preview of media for illicit images or pornography
2. Where are these kiosks located?
They are located in the OCRCFL's reception lobby area and are accessible to all law enforcement officers during normal business hours.
3. Do we have to make an appointment to use the kiosks?
Appointments are not required. You may, however, want to call the laboratory to ensure that there is not a line in front of you. The equipment is designed to be used by case agents and investigators at their convenience, with most reviews being completed within a matter of a few minutes. Please note that we cannot make reservations for use of the Kiosk. It is first come, first serve.
4. What is the OCRCFL cell phone kiosk case acceptance policy?
- PARTICPATING AGENCIES
- All Participating Agencies should process their cell phone requests through the Self Service Kiosk before making a request to the OCRCFL for a laboratory examination of a cell phone.
- Exceptions to the use of the Self Service Cell Phone Kiosk before submitting the cell phone(s) for forensic examination can be granted by the Laboratory Director, or his designee.
- If you need assistance using the Self Service Kiosk, please ask for the OCRCFL Duty Examiner. The Duty Examiner will assist you with the Self Service Kisok as necessary.
- NON-PARTICPATING AGENCIES
- All Non-Participating Agencies must process their cell phone requests through the Self Service Kiosk before making a request to the OCRCFL for a laboratory examination of a cell phone.
- If you need assistance using the Self Service Kiosk, please ask for the OCRCFL Duty Examiner. The Duty Examiner will assist you with the Self Service Kiosk as necessary.
Training
Click a question to unhide/hide its answer.
1. What types of training will the OCRCFL offer?
Right now, the OCRCFL plans to offer four "core" training classes at the OCRCFL. A link to our training website can be found here. If you are not immediately taken to the registration Web site, click here and enter the code ORA84789. The four classes you can sign up for training now at the OCRCFL are:
- Intro to the OCRCFL
- Digital Search and Seizure for First Responders (Bag and Tag)
- Image Scan 3
- Case Agent Investigative Review Training (CAIR)
You sign up for these classes on the OCRCFL website – www.ocrcfl.org. The training will take place in the OCRCFL training classroom.
2. How do I sign up for training at the OCRCFL?
Look for the Training Room link on the left-hand side of this page and navigate over to the training section. A link to our training website can be found here. If you are not immediately taken to the registration Web site, click here and enter the code ORA84789.
Find the class you want to go to and read about it to make sure it is right for you. The page will then navigate to our OCRCFL training class website where you can sign up for OCRCFL training on-line. Sign up for your desired class. Make sure you leave us your contact information in case a class has to be cancelled or re-scheduled. We value your time and don't want you to have to make an unnecessary trip to the lab if we have to alter the training schedule a bit.
3. How often will the training be offered at the OCRCFL?
It depends on the class you want to take. For example, we hope to make the following training schedule goals:
- Intro to the OCRCFL
- Twice a week
- Digital Search and Seizure for First Responders (Bag and Tag)
- Once a month
- Image Scan 3
- Once a month
- Case Agent Investigative Review Training (CAIR)
- Once a month
You may take just one of these classes, or all of these classes if you wish. If you have any problems, please e-mail us at octraining@rcfl.gov and someone will contact you within 2 business days to help you solve your issues or problems.
4. Will any other training classes be offered at the OCRCFL?
YES. These are the four we will use to start the OCRCFL training cycle. We hope to do other types of training classes down the road as well. Please let us know of any suggestion for training you may have by emailing us at octraining@rcfl.gov.
Case Agent Investigative Review (CAIR)
Click a question to unhide/hide its answer.
1. What is the Case Agent Investigative Review (CAIR) process?
CAIR is a program designed to significantly decrease the amount of time it takes a case agent or an investigator to have access to data from digital media submitted to the OCRCFL for forensic examination.
In short, once the digital media is submitted for examination to the OCRCFL, we will make a determination as to whether your Request for Service is CAIR eligible. If it is, we would then image your digital media, "pre-process" it for your review and then invite you down to the OCRCFL to review your data in a forensically protected environment.
This process is usually much quicker than the traditional "content review" and allows you, as a case agent or an investigator, to start reviewing your data weeks, if not months, sooner than the traditional content review methods used in the past.
You will be able to look at the data on your submitted digital media in a safe manner and "tag" (identify) files of interest that may immediately enhance your investigation. We will then provide you with a CD-R/DVD-R with your tagged files of interest.
We would then close your request pending a further need for our services.
2. How will I know if my case is CAIR eligible?
Right now, 100% of all federally submitted Request for Service submissions are worked using the CAIR program. This has led to a significant decrease in case backlog, as well as with turnover times.
Our hope in the OCRCFL is to eventually have up to 50% of state and local cases submitted to the OCRCFL for forensic examination undergo a CAIR examination initial. For now, all state and local Request for Service submissions will be reviewed, for the purposes of CAIR, on a case-by-case basis.
3. Does CAIR replace the need for a more traditional forensic examination?
No. CAIR is designed to supplement traditional forensic examinations, not replace them. CAIR has enabled us to provide data to case agents and investigators in a significantly shorter time frame than when we used to only conduct traditional content review forensic examinations.
When you submit a Request for Service to the OCRCFL, where CAIR is to be used, you will be contacted by a forensic examiner when the case is ready for your initial CAIR review. You will then work side-by-side with your assigned forensic examiner to review the data you submitted at our laboratory. In many cases, you may be able to review your data on-line if you completed the CAIR training provided by the OCRCFL.
Once you have had a chance to review and "tag" the files you think may be relevant to continuing your investigation, we will provide you a CD/DVD containing those particular files. You may review your data, as long as you think is necessary, while the CAIR process is on-going.
If you have any technical problems, or have specific questions, your assigned forensic examiner will be available to assist in as necessary.
When your CAIR examination is complete, we will close the Request for Service you had originally submitted. If it turns out that your request requires additional forensic examination support beyond what the CAIR examination is designed to provide, you are invited to submit a new Request for Service forensic examination request that may be assigned to a forensic examiner for additional case support.
4. Will the OCRCFL provide me training on how CAIR works before I use it?
YES. The OCRCFL will have a one-day training course at the OCRCFL, approximately once a month. Additional classes will be scheduled if the demand exists.
Please remember, however, that you will still have a forensic examiner assigned to every CAIR request in the laboratory, whether you have gone through the one day CAIR training or not. You will never be asked to do anything in the OCRCFL without someone to assist you.
You can sign up for the one-day OCRCFL CAIR training class here. If you are not immediately taken to the registration Web site, click here and enter the code ORA84789.
5. How long will it take to get results back from CAIR cases?
This is really up to you. The more time you spend with our forensic examiner reviewing your CAIR data, the faster we can get you your final data product.
With the CAIR tool, we hope to have your CAIR data ready for review within 7 to 10 working days on average from the date of your Request for Service submission. This will depend mainly on how much overall data you have submitted to the OCRCFL for review and the overall priority of your case in the OCRCFL case prioritization system.