The Criminal Investigation Division’s (CID) Cybercrimes Unit (CCU) shall provide technical support and expertise to investigators who seize computers or other digital devices as part of their investigation.
THE CCU’S ROLE

The CCU has a digital forensics laboratory with a wide range of digital forensics software tools. This facility provides a secure environment for imaging media and recovering evidence.

When requested, the unit shall provide expert technical support to investigators for the preservation, recovery, and analysis of evidence.

A. The unit shall only assist with computer related tasks for an investigation. The investigative unit to which the case is assigned shall remain responsible for the case.

B. The unit shall accommodate requests to respond to search warrants and other on site investigations that require technical expertise.

C. Requests for CCU support shall be initiated by submitting a Digital Forensics Work Request,
HPD 513E form, through a follow-up report in the Records Management System.

D. Emergency requests outside of normal business hours shall be made through the Communications Division
which shall contact the on-duty CID Lieutenant or designee.

RECOVERING DIGITAL EVIDENCE

In accordance with Policy 8.13, HANDLING OF EVIDENCE AND FOUND PROPERTY, the Property Report, HPD 192A form, shall be prepared by each departmental employee who accepts, recovers, or seizes devices that may contain digital evidence. The report shall describe the factors and circumstances by which the property was obtained and itemize each piece of property. As evidence, the equipment must be safeguarded against tampering and the chain of custody shall be strictly maintained.

A. Investigators shall provide the CCU with the relevant facts and circumstances of the case and a copy of the search warrant, consent form, or administrative request form.

B. Investigators are not required to notify the CCU in advance of seizing computers or other digital devices as evidence.

C. Computers and digital devices shall be submitted for storage to the Evidence Room of the Records and Identification Division. The CCU may accept custody of devices during normal business hours with prior notification and agreement with the unit’s personnel.