The proliferation of personal computers changed how computers were involved in criminal issues. In the past, computers were often used primarily as the attack platform or target of the attack now the more personal use of computes creates a situation where the computer is the storehouse of evidence relating to almost every type of crime imaginable. The result is that more computers are involved in some manner in crime and that more computers need to be examined for information of evidentiary value. But before they can be examined, they must be seized.

Previously, the highly trained computer specialist would attend to each seizure personally; however, the proliferation of computers and their use in criminal endeavors made personal attention to each case impractical. In some areas of the country, one specialist may serve an entire region. It is clearly unreasonable to believe that one specialist will be able to perform each seizure and complete the examination of the digital evidence for every crime with a cyber component. To fill this apparent gap in need versus capability, state and local law enforcement agents have become involved in recovering digital evidence from a crime scene where a computer is directly involved. Not only are state and local investigators faced with dealing with a new type of crime, but they are also asked to perform the seizures of digital evidence.

The on-scene responders/investigators often know very little about computers and often have not been instructed on how to...