DPS Laboratory Case Number:
Agency	Phone #
Agency Contact (Please Print)	Agency Case #

Please read the below fully and carefully:

Manual Examination (select “Yes” to accept all risks and authorize a manual examination, if necessary) A manual examination may be performed when data extraction techniques are unsuccessful or unavailable. The process consists of booting the device, manually navigating the device, and recording any notable data to provide in a report. The risks include inadvertently altering or deleting data.	Yes No
Evidence Repair (select “Yes” to accept all risks and authorize evidence repair, if necessary) It may be necessary to perform basic evidence repair to restore the device to working order to perform data extraction. Examples include replacing the screen, button, port, battery, or other hardware. The risks include inadvertently damaging the device further. Repair will be performed only after data extraction has been attempted and unsuccessful. Components, if purchased by the laboratory, will be removed prior to returning the evidence. It may be requested that the submitting agency provide the necessary components for evidence repair.	Yes No
Data Dump (select “Yes” to accept all risks and authorize a data dump only with NO analysis performed) It is possible that evidence from a data dump may not be located or identified unless examined by a trained and qualified examiner. Additionally, it is possible that forensic tools used may not parse or decode all data present on the device. If relevant information is not located when viewing the data dump, please request a forensic examination of the evidence. If examination is requested at another date, a new submission request must be made. Due to the large amount of data that may be dumped, it may be necessary to submit blank media (e.g. 500GB external hard drive or larger) on which to copy the data.	Yes No
Live Acquisitions (select “Yes” to accept all risks and authorize a live acquisition, as a last resort) At times it may be necessary to boot evidence to obtain a live acquisition (an acquisition of evidence while it is powered on and the operating system is booted). This may apply to full-disk encrypted computers, all-in-one systems, certain Mac computers, RAM dumps, or other situations in which the internal memory cannot be cloned using traditional methods. This process will only be performed as a last resort. The risks include inadvertently altering or deleting data.	Yes No
Passcode Suggestion (select “Yes” to accept all risks and authorize passcode suggestion, as a last resort) In situations where a device is passcode protected and brute-force is not currently supported by forensic tools, an analyst may be able to try a passcode that was used on other devices owned by the subject. It is not uncommon for users to use the same passcode across all their devices. This would be attempted as a last resort only, and when brute-force is not supported. Risks include the possibility that the device is set to permanently delete all data following a certain number of incorrect passcode entries.	Yes No

Acknowledgement

Please note that there is inherent risk of degradation or damage to Digital/Multimedia evidence due to the mechanical nature of electronic evidence. All efforts to preserve the evidence will be made by the laboratory. Despite proper evidence handling, it is possible that evidence can be affected by forensic equipment or data extraction techniques.	Acknowledged

Agency Contact Signature	Date