Skip to Main Content
Official Seal - DoD Cyber Crime Center - Air Force Office of Special Investigations


DoD Cyber Crime Center

Air Force Office of Special Investigations

A Federal Cyber Center

Defense Computer Forensics Laboratory (DCFL)

DC3's Defense Computer Forensics Laboratory (DCFL) performs Digital and Multimedia (D/MM) forensic examinations, device repair, data extraction, and expert testimony for DoD. The lab's robust intrusion and malware analysis capability supports other DC3 lines of business and activities.

DCFL operations are accredited under ISO 17025 by the American Society of Crime Laboratory Directors/Laboratory Accreditation Board (ASCLD/LAB) which guides reliable, repeatable, and valid exam results, subjected to quality control and peer review.

The DCFL Case Tracking System is now available online.

Contact DCFL

Customer Support
DSN 622-2595
Fax 410-981-0183
Submit Request Forms
General Lab Questions
Technical Difficulties

DCFL processes cases involving:

  • Counterterrorism

  • Counterintelligence Matters

  • Crime Against Persons & Property

  • Network Intrusions

  • Malware

  • Fraud

  • Enhancing Video & Voice Recordings

  • Aircraft Mishaps

  • Damaged Media & Submerged Devices

  • Cell Phones, Tablets & Other Mobile Devices

  • Encryption

How To Submit A Case

If you have any questions, please contact DCFL Customer Support at or 410-981-0310.

Step 1-Download


Select and download the appropriate form from the list below.

Step 2-Complete


Please complete the form providing as much information as possible and be sure to sign it.

Step 3–Print


After completing and signing the form, please print out a copy to include with your evidence submission.

Step 4–Submit


Mail the complete and signed form along with original evidence to DCFL.

  Data Tape, Log File, and Multimedia Submission Tips


Damaged Media Recovery Tips

These tips can significantly increase the chances of success in your recovery when submitting items for Damaged Media Recovery

Do not attempt to recover data from a damaged device

Many people have sent DCFL devices that could have been recovered, but their attempts made additional recovery impossible.

Send a donor device that matches the original as closely as possible

Same make/model/size, site code, date code, etc.


Include a drive for the data when you submit your package

Please advise if you plan to perform the examination of the data yourself after recovery.

Send all power cables and unique data interface cables


If device is visibly broken, collect and send all pieces

Even very small pieces may have critical components, or contain information and clues that can be very useful in the repair of the device.

Stabilize the device as much as possible

Attempt to prevent the device from further damage and contamination from its surrounding environment.

Hard drives that contain platters are extremely sensitive to any kind of particles in the air

If you are sending a hard drive that has a breach exposing the internal cavity of the drive to the outside environment, attempt to stop continued contamination by sealing the drive in an anti-static bag or other means with equal or greater physical and environmental protection.

Submerged Items

Several factors come into play when preparing captured devices for shipment and/or storage if they have been submerged. These factors will determine whether or not the item should remain submerged in its original substance and what other kinds of preparations should be made on the device.

  • How long has it been submerged?
  • What is the substance in which it is submerged?
  • What kind of device is it?