DC3 Mission

Cyber Forensics Laboratory

DC3's Cyber Forensics Laboratory performs Digital and Multimedia (D/MM) forensic examinations, device repair, data extraction, and expert testimony for DoD and allied agencies.

Submit a Case View Forms & Resources
 
Submission Process Review the required steps to prepare and submit digital evidence to CFL. Forms & Resources Download the service request form, litigation support form, and submission guidance. Best Practices Protect devices from further damage and improve the chances of successful recovery. Contact CFL Reach Cyber Forensics Laboratory customer support for intake and coordination questions.

Seeking immediate response?

Please indicate what information you require sooner than the end of a final exam on your Service Request form. Please be advised that Quick Look results are not a final report and do not replace your exhaustive forensic examination. These results are not intended to stand on their own in a judicial process.

Digital forensic support built for mission and evidentiary integrity

The Cyber Forensics Laboratory supports DC3 customers through comprehensive forensic examinations, damaged device recovery, expert testimony, and technical coordination for complex digital evidence needs.

This page is structured so users can quickly understand CFL’s capabilities, move into the submission process, and access the forms and guidance needed to prepare evidence correctly the first time.

  • Performs comprehensive Digital and Multimedia (D/MM) forensic examinations for DC3 customers.
  • Recovers data by repairing damaged devices and extracting information that is otherwise inaccessible.
  • Provides expert witness testimony in legal proceedings and supports intrusion/malware analysis for law enforcement, counterintelligence, and DIB partners.
  • Develops digital investigation requirements and standards in partnership with the Defense Cyber Operations Panel.
  • Maintains ISO 17025 accreditation, ensuring all forensic results are valid, reliable, and repeatable under strict quality control.

At-a-glance value

D/MM Exams Comprehensive digital and multimedia forensic examinations for supported customers.
Device Recovery Repair and extraction support for damaged or otherwise inaccessible devices.
Expert Testimony Support for legal proceedings with defensible forensic findings and expert witness capability.
ISO 17025 Accredited processes designed for valid, reliable, and repeatable forensic results.

Core CFL capabilities

These core service areas are central to how CFL supports mission partners, investigators, and legal stakeholders. Breaking this section out visually helps users immediately understand the lab’s primary value.

Placeholder image for digital forensic examinations

Digital & Multimedia Examinations

CFL performs comprehensive Digital and Multimedia forensic examinations for DC3 customers, supporting mission, investigative, and evidentiary requirements.

Placeholder image for device repair and data extraction

Device Repair & Data Extraction

CFL recovers data by repairing damaged devices and extracting information that may otherwise be inaccessible through standard handling methods.

Placeholder image for expert witness and litigation support

Expert Witness & Litigation Support

CFL provides expert witness testimony in legal proceedings and supports intrusion and malware analysis for law enforcement, counterintelligence, and DIB partners.

Submission process

Follow these steps to prepare the correct paperwork and package your evidence for CFL review and intake. This workflow is one of the highest-value task paths on the page, so it deserves stronger visual emphasis.

Step Action Details
1 Download Select and download the appropriate form from the list below.
2 Complete Complete the form with as much information as possible and sign it. Contact the Cyber Forensics Laboratory for coordination if needed.
3 Print Print a copy of the completed and signed form to include with your evidence submission.
4 Submit Mail the completed form and original evidence, including power and data cables, to the Cyber Forensics Laboratory. For the mailing address, call 410-981-0310 or 622-2595.

Forms & resources

Download the required CFL forms and supporting submission guidance before mailing evidence.

Note: If you see a “Please wait...” message when opening a form, follow these instructions to adjust your browser settings. You may need to right-click and select “Save Link As...” to download the files.

Service Request Form

Use this form to initiate a forensic service request and include it with your evidence submission.

Download Form

Litigation Support Request

Use this form when requesting CFL litigation support for legal proceedings and related forensic needs.

Download Form

Submission Tips

Review guidance for submitting data tapes, log files, and multimedia with your evidence package.

View Guidance

Best practices

Following these tips can significantly increase the chances of a successful data recovery.

Do Not Attempt Self-Recovery

Many devices that could have been recovered become permanently damaged after failed recovery attempts. Resist the urge to fix it yourself.

Inform Us of Your Plans

If you plan to perform your own examination of the data after recovery, please let us know and include an empty drive for the recovered data in your submission package.

Send All Pieces

If a device is visibly broken, collect and send all fragments. Even very small pieces can contain critical components or vital information for the repair.

Prevent Further Damage

Protect the device from further physical damage and environmental contamination. For hard drives with exposed internal parts, seal them in an anti-static bag.

Handle Submerged Items Correctly

If a device has been submerged, proper handling is crucial. Please contact us for specific instructions, as the correct procedure depends on several factors.

Questions about submitting evidence?

Contact Cyber Forensics Laboratory Customer Support at afosi.dc3.cflintake@us.af.mil. For mailing address coordination, call 410-981-0310 or 622-2595.

Email CFL Support Get Submission Forms

Damaged Media Recovery Tips

Best Practices

Following these tips can significantly increase the chances of a successful data recovery.

Do Not Attempt Self-Recovery

Many devices that could have been recovered become permanently damaged after failed recovery attempts. Resist the urge to fix it yourself.

Inform Us of Your Plans

If you plan to perform your own examination of the data after recovery, please let us know and include an empty drive for the recovered data in your submission package.

Send All Pieces

If a device is visibly broken, collect and send all fragments. Even very small pieces can contain critical components or vital information for the repair.

Prevent Further Damage

Protect the device from further physical damage and environmental contamination. For hard drives with exposed internal parts, seal them in an anti-static bag.

Handle Submerged Items Correctly

If a device has been submerged, proper handling is crucial. Please contact us for specific instructions, as the correct procedure depends on several factors.