2006 RCFL Program Report

Digital Forensics
It’s a Bull Market

05/07/07

When the U.S. went to court against Enron, prosecutors arrived with a virtual mountain of evidence gleaned from data—more than 31 terabytes of data—gathered and analyzed during the FBI’s five-year investigation. To put that into perspective, a terabyte is equivalent to about 250 million pages of text, which would stack 10 miles high if printed on both sides of the page.

How did investigators digest and make sense of the sheer volume of information? They turned to the Greater Houston Regional Computer Forensics Laboratory, one of our 14 RCFLs, as they are called, that provide digital forensics services and training for more than 4,300 law enforcement agencies across 16 states. The RCFL in Houston processed data from 130 computers, thousands of e-mails, and more than 10 million pages of documents, culling evidence that helped deliver convictions of the company’s top executives, among others.

The Enron case is one of the many success stories highlighted in an annual report of the RCFL Program, which began as a pilot in San Diego in 1999 and has evolved into a network of cutting-edge digital evidence labs created to meet the burgeoning need. Last year alone, RCFLs—staffed by the FBI and trained computer analysts from more than 100 other agencies—collectively analyzed 59,677 media items, including CDs, cell phones, hard drives, and PDAs.

“Computers are the crime scene of the new millennium,” U.S. Attorney Patrick Meehan said at last year’s opening of the Philadelphia RCFL.

Among the Fiscal Year 2006 highlights of the RCFL Program:

- Opened four new labs—in Denver, Philadelphia, Buffalo, and Dayton. A 14th lab opened in Kentucky in October (the start of a new fiscal year) and is not reflected in the report;
- Conducted 3,633 digital forensics exams;
- Processed 916 terabytes of data;
- Trained 4,500 law enforcement personnel in various digital forensics techniques;
- Supported high-profile investigations, such as Enron, the bribery case against ex-Congressman Randy “Duke” Cunningham, the public corruption case against ex-Governor George Ryan, and the dissolution of an international child porn ring.

During 2006, requests for assistance on cyber crime—which includes child pornography and other violent acts against children—were the most frequent in 11 of 13 RCFLs, followed in varying degrees by violent crimes, major thefts, and white collar crimes.

“The RCFL is a tremendous resource we use in every one of our cyber-crimes cases,” Eric Zahnd, a county prosecutor in Missouri, says in the report.

The 63-page report, issued in March, profiles each of the RCFLs in detail, including their history, participating agencies, the number and type of examinations they performed, and their challenges going forward.

For the overall program, which has an $8.8 million operating budget, the top challenges are to increase the number of participating agencies—today, 110 agencies are partnered with the RCFL Program—and to increasing efficiencies with more personnel and technology to meet the growing demand.

Resources:
- RCFL Program Annual Report for Fiscal Year 2006 (pdf)
- RCFL National Program Office
- Inside the High-Tech World of RCFLs (2006)
- RCFL Opens in Silicon Valley (2005)