dc3 mission

Cyber Forensics Laboratory

DC3's Cyber Forensics Laboratory performs Digital and Multimedia (D/MM) forensic examinations, device repair, data extraction, and expert testimony for DoW and allied agencies.

Submit a Case View Forms & Resources
 
Submission Process Review the required steps to prepare and submit digital evidence to CFL. Forms & Resources Download the service request form, litigation support form, and submission guidance. Best Practices Protect devices from further damage and improve the chances of successful recovery. Contact CFL Reach Cyber Forensics Laboratory customer support for intake and coordination questions.

Seeking immediate response?

If you require preliminary information before completion of the final forensic examination,
identify the specific information needed on the Service Request form.
Please be advised that Quick Look results are not a final report and do not replace your exhaustive forensic examination.
These results are not intended to stand on their own in a judicial process.

mission overview

Cyber Forensics Laboratory

The Cyber Forensics Laboratory performs Digital and Multimedia (D/MM) forensic examinations, repairs damaged devices and extracts otherwise inaccessible data, and provides expert testimony in legal proceedings for DC3 customers. The lab also analyzes system and network intrusions and reverse-engineers malware to support law enforcement, counterintelligence, and Defense Industrial Base activities.

Additionally, the Cyber Forensics Laboratory collaborates with the Defense Criminal Investigative Organizations Chartered Action Group for Digital Forensics and Cyber Activities (DFCA) to develop requirements and set standards for digital investigations as new technologies emerge and evolve.

The Cyber Forensics Laboratory’s main and Southwest locations are accredited to ISO 17025 by the ANSI National Accreditation Board for their acquisition/extraction and content analysis activities, which are subject to strict quality-control and peer-review procedures. The Cyber Forensics Laboratory produces results that are valid, reliable, and based on conditions and methods that are repeatable and verifiable.

Seeking immediate response? Please indicate what information you require sooner than the end of a final exam on your Service Request form.

Please be advised that triage results documented in an interim laboratory report are not final, are not intended to be used as evidence in a court of law, and do not replace a comprehensive forensic examination.

CFL at a glance

D/MM Exams Comprehensive digital and multimedia forensic examinations for supported customers.
Device Recovery Repair and extraction support for damaged or otherwise inaccessible devices.
Expert Testimony Support for legal proceedings with defensible forensic findings and expert witness capability.
ISO 17025 Accredited processes designed for valid, reliable, and repeatable forensic results.

Core CFL capabilities

These core service areas are central to how CFL supports mission partners, investigators, and legal stakeholders.

Digital & Multimedia Examinations

CFL performs comprehensive Digital and Multimedia forensic examinations for DC3 customers, supporting mission, investigative, and evidentiary requirements.

Device Repair & Data Extraction

CFL recovers data by repairing damaged devices and extracting information that may otherwise be inaccessible through standard handling methods.

Expert Witness & Litigation Support

CFL provides expert witness testimony in legal proceedings and supports intrusion and malware analysis for law enforcement, counterintelligence, and DIB partners.

Submission process

Follow these steps to prepare the correct paperwork and package your evidence for CFL review and intake.

Step Action Details
1 Download Select and download the appropriate form from the list below.
2 Complete Complete the form with as much information as possible and sign it. Contact the Cyber Forensics Laboratory for coordination if needed.
3 Print Print a copy of the completed and signed form to include with your evidence submission.
4 Submit Mail the completed and signed form with the original evidence to the Cyber Forensics Laboratory. Include all power cables and unique data-interface cables.
For the mailing address, call 410-981-0310 or 622-2595.

Forms & resources

Download the required CFL forms and supporting submission guidance before mailing evidence.

Note: If you see a “Please wait...” message when opening a form, follow these instructions to adjust your browser settings. You may need to right-click and select “Save Link As...” to download the files.

Service Request Form

Use this form to initiate a forensic service request and include it with your evidence submission.

Download Form

Litigation Support Request

Use this form when requesting CFL litigation support for legal proceedings and related forensic needs.

Download Form

Submission Tips

Review guidance for submitting data tapes, log files, and multimedia with your evidence package.

View Guidance

Best practices

Following these tips can significantly increase the chances of a successful data recovery.

Do Not Attempt Self-Recovery

Many devices that could have been recovered become permanently damaged after failed recovery attempts. Resist the urge to fix it yourself.

Inform Us of Your Plans

If you plan to perform your own examination of the data after recovery, please let us know and include an empty drive for the recovered data in your submission package.

Send All Pieces

If a device is visibly broken, collect and send all fragments. Even very small pieces can contain critical components or vital information for the repair.

Prevent Further Damage

Protect the device from further physical damage and environmental contamination. For hard drives with exposed internal parts, seal them in an anti-static bag.

Handle Submerged Items Correctly

If a device has been submerged, proper handling is crucial. Please contact us for specific instructions, as the correct procedure depends on several factors.

Questions about submitting evidence?

Contact Cyber Forensics Laboratory Customer Support at afosi.dc3.cflintake@us.af.mil. For mailing address coordination, call 410-981-0310 or 622-2595.

Email CFL Support Get Submission Forms