The Cyber Forensics Laboratory (CFL) performs Digital and Multimedia (D/MM) forensic examinations, device repair, data extraction, and expert testimony for DC3 customers. The lab’s robust intrusion and malware analysis capability supports law enforcement, counterintelligence, and Defense Industrial Base activities and operations. CFL also interacts with the Defense Cyber Operations Panel which consists of Defense Criminal Investigative Organizations and Military Department Counterintelligence Organizations to develop future requirements for innovative digital investigations. CFL is accredited under ISO 17025 by the ANSI National Accreditation Board which guides reliable, repeatable, and valid examination results, subjected to quality control and peer review.
CFL’s D/MM forensic processes include:
Select and download the appropriate form from the list below.
Please complete the form providing as much information as possible and be sure to sign it.
After completing and signing the form, please print out a copy to include with your evidence submission.
Mail the complete and signed form along with original evidence to CFL.
Data Tape, Log File, and Multimedia Submission Tips
Call CFL information line for the address at 410-981-0100 or 622-2595
**Note: You may need to right-click the link and select "Save Link As..." to download the file.** If you encounter any issues downloading or viewing the forms below (such as a "Please wait..." page), follow the instructions here to change your browser settings.
Many people have sent CFL devices that could have been recovered, but their attempts made additional recovery impossible.
Same make/model/size, site code, date code, etc.
Please advise if you plan to perform the examination of the data yourself after recovery.
Even very small pieces may have critical components, or contain information and clues that can be very useful in the repair of the device.
Attempt to prevent the device from further damage and contamination from its surrounding environment.
If you are sending a hard drive that has a breach exposing the internal cavity of the drive to the outside environment, attempt to stop continued contamination by sealing the drive in an anti-static bag or other means with equal or greater physical and environmental protection.