As the use of computers and digital devices has become widespread, C3's Computer Forensics Unit (CFU) has grown to support the investigative challenges of a digital world. These devices have greatly increased the volume of data that HSI special agents must examine during the course of an investigation. In addition, HSI investigators now must securely manage digital evidence that is highly volatile, mobile and subject to encryption by any user. This makes recovery and stewardship of evidence challenging.
Computer forensics agents/analysts (CFAs) are HSI investigators or analysts trained to perform forensic examinations of seized digital storage devices, such as computer hard drives, flash drives, PDAs, mobile phones, DVDs, CDs and tape media. They use all available digital evidence recovery techniques to preserve an item's authenticity and integrity while maintaining a strict chain of custody.
CFAs work in HSI field offices throughout the world to provide expertise on investigative strategies and to assist case agents in preparing search warrants targeting digital evidence. They are also called upon to furnish expert computer forensic testimony in criminal trials and they provide support to state and local law enforcement.
The CFU at HSI Headquarters manages the following programs that assist with the investigation of child exploitation:
- The Human Exploitation Rescue Operative (HERO) Child Rescue Corp program. This program is designed to give ill, injured, or wounded members of our Armed Forces a chance to join a mission, continue serving and combat child exploitation. Under this one-year paid internship, participants receive three months of training to become computer forensic analysts and participate in a nine-month field internship in an HSI field office supporting child exploitation investigations. Upon successful graduation from the program, many are offered permanent positions with HSI.
- Computer/Mobile/Vehicle/Drone Forensics. HSI is a leader in the field of digital forensics and has the largest computer forensic program in the Federal government, with more than 400 computer forensic agents and analysts. HSI CFAs provide training to other federal, state, local and foreign law enforcement partners in all digital forensic disciplines and provide tier 1 support to field offices.
- 3-D Printing has been used to help identify victims of child exploitation in cases where unidentifiable human remains have been discovered. In these cases, an MRI image is taken and loaded into the 3D printer. A replica of the skull is then printed and given to a forensic anthropologist at the National Center for Missing and Exploited Children for forensic reconstruction. The reconstruction is then run through facial recognition and identification is attempted.
- Hard Drive Repair. In many cases, individuals will attempt to destroy evidence contained on their digital devices. In other instances hard drives become damaged at the scene, or damaged hardware is discovered in the course of an investigation. The experts at C3 are trained to repair these drives and acquire digital evidence for use in prosecutions.
- Encryption/Decryption. Privacy concerns and inexpensive encryption capabilities have led to the ability to obtain evidence from encrypted devices. C3 has a robust decryption program that is powered by a network of computers placed in each SAC office which not only allows for the secure/encrypted transfer of evidence, but also allows investigators to combine the processing power of these computers to assist in decrypting digital devices.
CFAs are HSI investigators or analysts trained to perform forensic examinations of seized digital storage devices, such as computer hard drives, flash drives, PDAs, mobile phones, DVDs, CDs and tape media.