Search Warrants and/or Consent to Search forms are required for all Digital Multimedia Evidence (DME) cases, without exception. The search warrant or consent to search form should specifically contain the terminology requesting a “forensic examination” of the submitted evidence by the TXDPS Crime Laboratory.
THE FOLLOWING LANGUAGE IS USED TO DESCRIBE COMPUTER SYSTEM AND RELATED EQUIPMENT TO BE SEIZED AND ANALYZED
Digital media consists of computer hardware, computer software, computer data, and computer related documentation which can collect, analyze, create, display, convert, store, conceal, or transmit electronic, magnetic, optical, or similar digital impulses or data.
Computer hardware includes, but is not limited to, all data processing devices such as central processing units, memory typewriters, and self-contained “laptop” or “notebook” computers; internal and external storage devices and media such as hard disk drives, magnetic media disks and drives, magneto-optical disks and drives, tape cartridges and drives, optical disks and drives such as CD-ROM, CD-WORM, CD-R, CD-RW, and DVD, floptical disks and drives such as Zip, Jazz, Sparq, Syjet, and Bernoulli, transistor-like binary devices, and any external input/output devices such as mice, keyboards, monitors, scanners, printers, modems, cables, connections, recording equipment, microphones, RAM or ROM units, acoustic couplers, automatic dialers, speed dialers, programmable telephone dialing or signaling devices, cellular telephones, iPads, iPods, and electronic tone- generating devices; as well as any devices, mechanisms, or parts that can be used to restrict access to computer hardware (such as physical keys and locks).
Computer software includes, but is not limited to, digital information which can be interpreted by a computer and any of its related components, which may be stored in electronic, magnetic, optical or other digital form. It commonly includes programs such as operating systems, applications, utilities, compilers, interpreters, and communications programs. Computer data, which is digital information, is created with the use of computer software and stored electronically and/or magnetically in computer hardware. This computer system(s) may contain files with records; namely, correspondence, notes, papers, ledgers, personal telephone, address books, memoranda, telexes, facsimiles, and documents. It may also contain graphical images and photographs.
Computer related documentation, that is, written, recorded, printed, or electronically stored material which explains or illustrates how to configure or use computer hardware, software, or other related items
Based upon affiant’s knowledge, training, and experience, and consultations with ____________________________________________, who is trained and experienced in the search, seizure, and analysis of computer related evidence, affiant knows that it is necessary to seize most or all electronic and electro-magnetic storage devices (along with related peripherals) to be searched later by a person(s) trained to conduct computer evidence analysis. It may also be necessary to transport the actual computer hardware, software, and documentation, or duplicate copies of the data contained in each of these items, out of this county for complete and thorough examination by trained personnel in a laboratory or other controlled environment. This is true based on the following:
[05/16/2012] PEH-02-08: 1 of 2
The most current copy of The Physical Evidence Handbook is available at: http://www.txdps.state.tx.us
Version: 01
Template for Computer Search, Seizure and Analysis Warrant
1. The volume of evidence. Computer storage devices (like hard disks, diskettes, tapes, and compact disks) can store the equivalent of thousands of pages of criminal evidence; he or she might store it in random order with deceptive file names. This may require searching which particular files are evidence or instrumentality of crime. This sorting process can take weeks or months, depending on the volume of data stored, and it would be impractical to attempt this kind of data search on site.
2. Technical requirements. Searching computer system(s) for criminal evidence is a highly technical process requiring expert skill and a properly controlled environment. The vast array of computer hardware and software available requires even computer experts to specialize in some computer system(s) and applications, so it is difficult to know before a search which expert is qualified to analyze the system(s) and its data. In any event, however, data search protocols are exacting scientific procedures designed to protect the integrity of the evidence and to recover even “hidden”, erased, compressed, password- protected, or encrypted files. Since computer evidence is extremely vulnerable to inadvertent or intentional modification or destruction (both from external sources and from destructive code imbedded in the system(s) as a “booby trap”), a controlled environment is essential to the complete and accurate analysis. Based on the above mentioned facts, your affiant has probable cause to believe that the personal computer system(s) of [name of the suspect, witness, victim] may contain files and/or data with records – namely, correspondence, notes, papers, ledgers, personal telephone and address books, telephone toll records, telephone message slips, memoranda, telexes, facsimiles, documents, and photographs relevant to or which describe criminal conduct and suspected criminal activity, specifically, [describe offense(s) being investigated]
Wherefore, affiant asks for the issuance of a warrant that will authorize affiant to search for and seize said computer system(s), computer hardware and media, computer software, and computer documentation. Furthermore, said items are to be analyzed by a trained computer evidence recovery specialist in order to retrieve, restore, and/or reproduce any or all information believed to be evidence of said offense(s).
(OPTIONAL if return of computer system(s) is essential, i.e. business environments, etc.) If after examining the computer hardware, software, and documentation, investigators determine that any or all of these items are no longer necessary to retrieve, analyze, and preserve the data evidence, they will be returned to [suspect, witness, victim] within a reasonable time.
[05/16/2012] PEH-02-08: 2 of 2
The most current copy of The Physical Evidence Handbook is available at: http://www.txdps.state.tx.us