Webinar: Jefferson Parish leaders outline how to staff and run a digital forensics unit

Josh Vickers of the Forensic Technology Center of Excellence opened a webinar in the ASCLAD series with introductions and a disclaimer noting presenters’ views do not necessarily represent the U.S. Department of Justice. Chief Deputy Tim Scanlon of the Jefferson Parish Sheriff's Office framed the session as a commander’s view of digital forensics for laboratory managers and described three common organizational models: fully inside the crime laboratory, associated with the laboratory but under a different structure, or controlled within investigative units.

Tim Scanlon said each model has tradeoffs. ‘‘Not anybody who knows computers can do digital forensics,’’ he said, urging managers to avoid assigning forensic work to general IT staff. He recommended managers pick an initial focus—often mobile phones—and build capacity from there rather than attempting to cover every possible device at once. He also distinguished technicians (front-end collection and basic extraction) from analysts (deeper examination and interpretation) and recommended defining roles to prevent analysts being diverted into routine collection.

Steven Valeri, Digital Forensics Unit Supervisor for the Jefferson Parish Sheriff’s Office, delivered case examples illustrating why cross-discipline coordination matters. Valeri described ATM-skimming overlays with microSD cards and gas-pump trims where latent prints recovered from tape or duct tape produced investigative leads when combined with digital extractions. He also described using high-resolution images from phones to read firearm serial numbers and to recover ridge detail useful for latent-print comparison.

Both presenters urged organized preservation and review practices. Valeri outlined a workflow of identify, collect, preserve, analyze and added a formal review step to handle large volumes: ‘‘We work from a working copy and keep a clean backup on an evidence server,’’ he said, noting the need for geographically separate backups in hurricane-prone areas. He explained write blockers and forensic imaging and recommended analysts have multiple complementary software tools to verify results, rather than relying on a single vendor product.

On staffing and training, Scanlon and Valeri emphasized continuous education for analysts and for other laboratory units that may handle digital evidence. Scanlon encouraged expert-witness training for examiners and proactive communication with prosecutors and defense attorneys so courts understand what digital forensic analysis can and cannot show. Both recommended accreditation (ISO 17025 or ISO 17020 depending on state requirements) as a way to improve quality, while acknowledging accreditation increases documentation, review, and cost burdens.

The presenters concluded that digital forensics is rapidly evolving and resource intensive, and that managers must plan for growing data volumes, invest in targeted tools and training, and create clear policies that separate evidence collection from analysis. The webinar closed with an offer to share slide materials and follow-up contact information for attendees.