Digital Forensics Services

Digital Forensics Services (DFS) is an RCMP unit responsible for providing timely digital forensics support to all investigative units and detachments within the province.

DFS is mainly comprised of digital forensic examiners and technicians, who have extensive knowledge and training in capturing, analyzing and interpreting digital evidence. The forensic examiners produce court-ready, peer-reviewed technical reports using a variety of tools and techniques.

Exhibits and sources from which digital evidence may be gathered:

• Mobile devices – cell phones, tablets, laptops, point of sale machines
• Computer hard drives
• ATM machines
• Vehicles

Jobs within DFS

DFS employs a combination of RCMP officers and civilian employees in the following roles:

Digital Evidence Support Technician (DEST)

A Digital Evidence Support Technician (DEST) is trained in forensic acquisition of data from electronic devices, and produces review packages for investigators.

A DEST must complete a mandatory Exhibit Intake Training Program, which is a combination of classroom learning, commercial training courses, and field experience. The training is challenging and highly technical, requiring continuous upkeep to ensure all evidence is captured without compromising the data on the suspect devices.

Job qualifications

Candidates who are interested in a DEST position must have:

• A Degree or Diploma in Computer Forensics or other technology related discipline from a recognized post-secondary institution; or
  • Any number of courses in Computer Forensics or other Computer Science discipline from a post-secondary institution.
• Several years of work experience in a technical role.

Digital Forensics Examiner (DFE)

A Digital Forensics Examiner (DFE) has specialized training in conducting in-depth forensic interpretation and analysis of digital evidence, and produce technical examination reports that may be presented in court.

Example positions of a civilian DFE include Tech Crime Analysts or Senior Digital Evidence Specialists.

RCMP officer DFEs are Technological Crime Investigators.

Job qualifications

Candidates who are interested in a DFE position must have similar basic qualifications as a DEST:

• A Degree or Diploma in Computer Forensics or other technology related discipline from a recognized post-secondary institution; or
  • Any number of courses in Computer Forensics or other Computer Science discipline from a post-secondary institution.
• Several years of work experience in a technical role.

DFE training begins with the completion of the Digital Forensics Understudy Program, which is managed by the RCMP National Digital Forensic Program (NDFP). The program combines Canadian Police College (CPC) classroom learning in Ottawa, along with commercial training courses and field experience building.