Clallam County Sheriff

As ownership of mobile phones, laptops, tablets and other electronic devices continues to skyrocket, digital evidence is becoming an increasingly important part of criminal investigations. To help identify suspects and build strong cases against perpetrators, the Sheriff’s Office must sift through hundreds of gigabytes of data each year.

“During the course of a criminal investigation, it’s common for officers to seize hard drives and flash storage devices,” says Guy Cranor, special deputy – computer forensics analyst at Clallam County Sheriff’s Office. “To support our detectives with their work, we need to extract as much relevant information as we can from those devices—ranging from text documents, photos and video files to metadata showing when users were logged in and which websites they may have visited.”

External processing introduces delays

To ensure digital evidence is admissible in court, law enforcement agencies must follow strict data extraction, processing and reporting procedures. In the past, the Sheriff’s Office relied on an external lab to perform all these tasks, adding significant lead times to some investigations.

“Previously, the Sheriff’s Office lacked the capability to process digital evidence,” Cranor says. “Instead, an officer would drive seized storage devices to a specialist forensic lab to preserve the chain of custody—a six-hour round trip. Crucially, it often took several months to receive the results, potentially delaying criminal investigations.”

Enabling advanced digital forensics

To accelerate digital forensics processing and better protect residents across Clallam County, the Sheriff’s Office selected OpenText™ EnCase™ Forensic, a court-proven solution for identifying, collecting and preserving forensic data from a wide variety of devices.

“One of the things I appreciate the most about the OpenText solution is that it supports our entire digital forensics process from end-to-end,” Cranor says. “While we use additional tools to carry out tasks such as cloning drives or analyzing image metadata, it’s the OpenText solution that allows us to find and act on evidence—for example, by highlighting information of interest for detectives and building reports for prosecutors.”

Hitting the ground running

Using an OpenText Learning Subscription, Cranor rapidly got up to speed with the solution.

“The training I received through our OpenText Learning Subscription was extremely valuable,” Cranor recalls. “Even though the in-person sessions had to be carried out remotely because of the COVID-19 pandemic, I was very impressed by the quality of the instruction. The initial foundation class helped me to hit the ground running from day one, and the solution is now supporting active investigations at Clallam County Sheriff’s Office.”

Enhancing investigations using digital evidence

By enabling on-site forensics processing, the Sheriff’s Office can help detectives make better use of digital evidence to support their investigations.

“In the past, if the Sheriff’s Office received evidence from the lab that would point an investigation in a new direction, they needed to submit a new analysis request to the lab and wait for the results,” Cranor says. “Today, I can discuss the results of our forensic analyses with detectives as soon as I get them, and immediately follow up on their questions. As a result, it’s much easier for them to incorporate digital evidence into their investigations.”

Building rock-solid cases, faster

Previously, reliance on external resources meant that Clallam County Sheriff’s Office could process around three storage devices per month. Today, the organization can process three-times more drives in the same amount of time—accelerating investigations, reducing operational costs and freeing the state crime lab to assist other counties with their forensic needs.

“Our officers don’t need to spend hours every month transporting storage devices to the state lab, which reduces the cost of processing digital evidence by around 40 percent and frees up time for other work,” Cranor says. “Most importantly, we’re able to discover evidence that helps detectives apprehend criminals sooner. For example, we recently prosecuted a triple homicide case using evidence collected via EnCase Forensic to link the perpetrator with their crimes. Without a doubt, the OpenText solution is already playing an important role in protecting the people of Clallam County.”

Expanding digital forensics, keeping citizens safe

Looking ahead, the Sheriff’s Office aims to become a regional processing center in the Internet Crimes Against Children (ICAC) Task Force Program, a national network of coordinated law enforcement resources. This process could see the Sheriff’s Office scale out its digital forensics capabilities to support work across two or more neighboring counties.

“When it comes to crimes against minors, acting quickly to apprehend suspects is even more crucial, and thanks to EnCase Forensic, we now have that ability,” Cranor says. “The support we receive from OpenText is outstanding. Their team is always willing to answer our questions and advise on best practices, and we’re looking forward to working with OpenText to further enhance our digital forensics capabilities and better protect people across Clallam County.”