Federal Forensic Backlogs: Why Your Devices Sit for Nine Months.

Digital forensics labs for federal agencies often take about nine months before an examination of seized devices can begin. Many times, the agents assigned to investigate a case have already finished their interviews with relevant witnesses, but they cannot proceed with any further evidence gathering while awaiting the examination of digital devices by the laboratory examiner.

Agency-specific turnaround times differ sharply from figures published regarding the national backlog of digital evidence seized by federal authorities. The FBI maintains Regional Computer Forensic Laboratories (RCFL) located in more than a dozen cities throughout the United States. The Secret Service, while also playing a prominent role in federal digital forensics, focuses heavily on training federal and state examiners at the National Computer Forensics Institute in Hoover, Alabama.

Homeland Security Investigations and the Drug Enforcement Administration (DEA) both operate their own separate federal digital forensic labs. However, the vast majority of digital evidence is handled at the FBI’s RCFL labs. Surprising as it may seem, the fact that RCFL examiners process several petabytes of seized digital information annually, conducting thousands of examinations each year makes it difficult to keep up. Imaging a single multi-terabyte hard drive can consume a full working day of an examiner’s time. Due to the sheer volume of requests, RCFL examiners have a backlog stretching for several months. This reality explains why federal investigators frequently tell suspects and targets that the examination of their digital devices will only take a matter of weeks, then inform them that they will not have answers for nine months.

What Happens Before an Examiner Actually Reviews My Device?

Consumer storage capacities have continued to grow much faster than the number of federal digital forensics examiners. The backlog has reached such proportions that it is now common for seized devices to enter into a long queue at digital forensics laboratories. This means that queue time must be included when forecasting how long it will take for seized devices to be examined.

Another important factor is the gap between forensic acquisition and the substantive work of a forensic examiner. Forensic imaging typically takes far less time than it takes for a forensic examiner to review the relevant information contained within the image. As a result, imaging will usually finish well before an examiner can begin to review the image for evidence.

Digital Evidence Laboratory Workflow

The flow of processing information in a federal digital evidence laboratory can generally be broken down into five distinct stages. When an agent has acquired a digital image, they send it to the digital forensics lab. The digital evidence is then processed. Here is what that means for examiners involved in preparing a final examination report.

1. Queue Time

Before an examiner can even begin the forensic examination, there is often several months of queue time. This time is separate from all other stages in the forensic exam process.

2. Forensic Acquisition

The process of creating a forensic image from a device and transferring the image to storage can take a full day or longer. This represents the time before an examiner can begin substantive work on the device.

3. Automated Processing

Computer imaging, password recovery, and other automated processes are usually handled by tools that are separate from the examiner’s review and report preparation process. This happens after imaging and can take several additional days to weeks.

4. Examiner Review and Report Preparation

This is the substantive review that takes place after automated processing. It is during this stage that examiners identify relevant artifacts, review the artifacts, and prepare forensic reports for federal agents. This step takes more time than any other stage in the process.

5. Agent Review, Prosecutor Review, and Litigation

Once digital evidence has been analyzed and forensic reports have been prepared and provided to the agents, additional time must be factored in before the forensic reports lead to a formal indictment. In many cases, the report can trigger requests for additional interviews, warrant executions, or grand jury testimony. Prosecutor review can add several weeks or months to the process as well.

What Else Increases the Time it Takes to Process Digital Evidence?

In some cases, additional factors will further slow down the digital forensic process. These factors include encrypted devices. If a seized device is encrypted, it can take weeks or longer for the authorities to unlock the device before any of the standard forensic review procedures can even begin.

Seized files in cloud storage may require a similar amount of time. If agents have a search warrant to collect cloud storage data, it may take weeks to obtain the data and get it into a digestible format.

In addition, cases involving multiple devices can result in a backlog of work for the federal examiner. If a target of a federal digital forensics investigation had his house searched and five computers and ten phones seized, that constitutes multiple devices, all of which must be imaged, processed, and then review. This can extend the forensic examination by weeks and even months.

Which Federal Device Examinations Move to the Front?

Nine months is the average time that a device seized during a federal investigation will wait before a digital forensic examiner begins his or her review. While there are cases in which evidence is reviewed much faster than that, there are cases in which it is reviewed much slower. As a result, it is not uncommon for devices in federal custody to be held for up to two years without examination by forensic lab personnel.

With that said, there are five primary reasons why a device will move to the front of the line at a federal digital forensics lab.

1. The Type of Crime Involved

While the federal digital forensics lab examiners do their best to ensure that all cases move forward at an equal pace, they are not always able to do so. In cases involving child exploitation, terrorism, or violent crimes, examiners will often move these cases ahead of all others in their lab’s queue. In some cases, these types of cases will be handled in an emergency fashion. The lower down on the priority list are cases involving fraud, and (in some labs) drug and theft and property crimes. The case types that typically sit at the bottom of the list are white-collar crimes and federal tax offenses.

2. Approach of the Statute of Limitations

In addition to case classification, federal prosecutors and agents may try to expedite their cases by contacting the forensic lab examiner. When a prosecutor or agent decides that there is an urgent need to expedite a case, there are a few reasons why he or she may request that a case be moved to the front of the queue. One reason is if the Statute of Limitations is about to expire. This occurs when the statutory time limit for filing a criminal complaint is approaching, and there is still a significant amount of work to be done before an indictment can be obtained.

3. The Defendant Is in Custody

Another common reason why a digital forensics examiner will prioritize a case is when the suspect or target has been detained pending trial. When a defendant is in federal custody, this certainly increases the urgency with which prosecutors seek to prosecute the case. As a result, the defendants who have already been convicted or those facing trial in custody are often given higher priority in these queues.

4. Approaching the Trial Date

Approaching the date for trial can also justify a higher priority for examination in the digital forensic lab. When a defendant’s counsel has already filed pre-trial motions and a trial date has been set, prosecutors will need to complete any forensic examination as soon as possible. The same applies to the defendant’s counsel. Once the date is set, this becomes a priority case that may jump ahead of all others.

5. Victim Safety

Finally, victim safety issues can cause digital devices to be prioritized. While this is typically only a concern in cases involving violence, crimes against children, or terrorism, it still can be a major concern in fraud, identity theft, and other nonviolent cases as well. The same applies when there is a high probability that a defendant will destroy evidence in case a delayed examination allows him or her to identify the digital evidence that needs to be destroyed.

It is a known fact that Oregon temporarily suspended DNA testing in property crime cases in order to clear its backlog of untested rape kits. This is one of the most dramatic examples of prioritization in the justice system, but it also explains why the process of forensic examination is so slow for many defendants. When agencies have too much evidence to examine and the labs are at full capacity, examiners have to make hard choices. The results for white-collar defendants often mean they will have to wait a while.

Spodek Law Group, led by managing partner Todd Spodek, defends clients in federal criminal and white collar matters.

What Are Agents Doing While the Forensic Lab is Waiting?

You might wonder what agents are doing while your seized devices are sitting in their queue at the digital forensics laboratory. This is a great question, and here are the two most important answers:

First, in many cases, they have additional ways of obtaining the information they need without waiting on the digital forensic examination. Second, in many cases, they are waiting on the digital forensic examination for the same reason that you are.

Let’s explain why, in many cases, a federal investigation is slowed down, and the steps that you need to take to protect yourself.

1. Additional Ways to Obtain Evidence

While digital forensic examinations are the centerpieces of most federal computer crimes investigations, this is certainly not the only evidence the federal authorities are seeking. In addition to waiting on your examination, agents can also make grand jury subpoenas for bank records, phone records, or even the records of cryptocurrency transactions. Even if federal authorities have a search warrant, agents will often rely on a warrantless subpoena to obtain evidence.

Along with gathering other evidence for an indictment, agencies may conduct surveillance of targets, monitor internet traffic, and even recruit cooperators to wire a target of their investigation. Even if the digital forensics lab has successfully completed the forensic examination, agents may not have decided whether to target you based on that evidence alone. Even if the information is directly incriminating, agents may want to use this information in tandem with other evidence in order to make a case.

Many of these investigative tools may be nonpublic, and in addition, Grand Jury proceedings are secret as well, under Federal Rule of Criminal Procedure 6(e) and the Federal Grand Jury Statute. This means that you may not have any way of knowing that there is anything more to your case besides the digital devices that were seized.

2. Agents are Waiting too

In many cases, agents are waiting for information from a digital forensic laboratory, and you will only be a witness, subject, or target of their investigation. Depending on your classification, there is a good chance your case will eventually get dismissed with no charges filed. However, you will only learn that this happened through the findings of the digital forensics examiner.

Of course, there is another complication. Providers can be given a preservation request under 18 U.S.C. 2703(f). Providers can also be given a warrant that allows agents to examine the contents of the records that the account holders have accessed and sent. In these scenarios, providers of digital services allow federal authorities to access the account contents directly, and federal authorities do not need to request anything related to the examination of the devices seized during a search warrant. Even in many cases that lead to an indictment, the government uses a combination of these strategies. This combination can accelerate the investigation, or prolong it as well.

3. What is a Target and a Subject in a Federal Criminal Investigation?

It is a common misconception that investigators must first determine who is a target or a subject of their investigation before they can begin to acquire evidence. In fact, a person’s status depends on the investigation’s scope and the evidence developed. Under Justice Manual § 9-11.151, a subject is a person whose conduct is within the scope of the investigation, while a target is a putative defendant linked to a crime by substantial evidence.

The distinction between a subject and a target is laid out in Justice Manual § 9-11.151 and is the following:

• Subject: A subject is someone who is within the scope of the investigation but whose conduct is not necessarily criminal. In criminal proceedings, prosecutors and defense counsel will refer to the government’s burden of proof, which is beyond a reasonable doubt. Even if the government can meet this burden, federal agents and prosecutors are reluctant to indict. Under Justice Manual § 9-27.220, prosecutors should commence or recommend federal prosecution when they believe the admissible evidence will probably be sufficient to obtain and sustain a conviction.
• Target: A target is a person as to whom the prosecutor or grand jury has substantial evidence linking the person to a crime and who, in the prosecutor’s judgment, is a putative defendant. When the federal government identifies you as a target, this makes it more urgent that the government acquires more and all available evidence so they can decide to issue an indictment.

Can I Force the Government to Return My Device?

There are no specific limitations in the Federal Rules of Criminal Procedure related to the government’s ability to examine seized devices. While Rule 41(e)(1) says that the warrant execution “shall be done within 14 days after the date of its issuance,” this is about when the government takes custody of the device or data. Rule 41(e)(2)(B) is more vague when the review of the imaging takes place off-site. As a result, the courts have generally held that Rule 41(e)(2)(B) does not impose any deadline on the government’s ability to conduct a digital forensic examination of a seized device.

I Can File a Rule 41(g) Motion for Return of Seized Property

You can certainly ask the government to return your digital device. While the Federal Rules of Criminal Procedure are silent on the time allowed for the government to conduct a forensic review, they contain a specific provision for a motion for the return of seized property. Rule 41(g) allows the owner of the seized property to make a motion to the courts to order the government to return the property when “the rule does not provide for its disposition.”

Although this rule is the general provision for seized property, the Fourth Circuit has acknowledged its application to digital evidence as well. Federal prosecutors argue that this provision applies only to physical property, but this argument will not work. Digital evidence is also stored physically, and digital forensic reviews take up a large amount of space in laboratories. As a result, digital forensic examiners are reluctant to store imaging of seized devices indefinitely.

The federal district courts generally won’t issue an order for the return of the device unless they believe that you can meet the high standard for irreparable harm. When the case is still at the pre-indictment stage, federal courts will defer to the agent’s decision to determine what is necessary to seek a formal indictment.

Even so, the government can still be compelled to return your device. Once the government has a forensic image of a device, there is generally no need for them to keep the original.

At the digital forensics lab, examiners must create a forensic image to review the data. If you filed a Rule 41(g) motion for the return of a seized device, and the forensics laboratory have successfully imaged the device, there is a good chance that the judge will rule in your favor. When this happen, agents must return the original device or the original information from the device.

Moreover, in addition to the return of original devices, agents can also enter into a “narrowing agreement” that determines what a forensic examiner may search and review. If agents only need certain bank records, medical records, password records, or email communications, then the government can limit their search, and this limits the review to only the relevant documents of interest. When this is the case, all of these other documents and other pertinent files are deemed irrelevant, and federal examiners only search for the information sought under the narrowing agreement.

Federal prosecutors and agents will enter these narrowing agreements if the defense can demonstrate that the federal forensic lab examination would have a substantial effect on the target’s personal or business interests. Narrowing agreements can have significant consequences in federal cases. For the targets, this narrows the focus of federal digital forensics, and for the government, it can speed up the examination time.

Challenging the Digital Forensic Examination under the Fourth Amendment

A federal criminal defense attorney can also challenge the Fourth Amendment during pre-indictment investigations and during digital forensic examinations. Prolonged retention can be unreasonable as it extends past the scope of a search warrant or subpoena. The Fourth Amendment states:

“the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, except upon probable cause, supported by Oath or affirmation.”

The Fourth Amendment prohibits unreasonable searches and seizures. This applies to federal criminal cases as well. If prosecutors are holding onto seized digital devices longer than they need, the Fourth Amendment prohibits prosecutors from doing that. This can apply to individuals as well, not just to corporations.

The problem is that this is a gray area in federal law. To challenge this, you must work with an experienced federal criminal defense lawyer who can explain the relevant laws and constitutional standards to judges. This attorney can assist with everything from seeking a return of the seized devices to narrowing the scope of the review.

There are cases that last for decades. But that is not the case here. Even though the government has a lot of leeway, this does not mean your case can drag on without a definitive end. If the prosecutor will not go to court, your attorney can contact the forensic examiner, negotiate with them, and get a better understanding of the duration of the federal digital forensic examination.

Ultimately, the duration of a federal digital forensic investigation depends on the digital forensic lab examiner and the agent assigned to your case. If the federal prosecutor decides to file charges, this will depend on the duration of the digital forensic examination. Thus, a prompt and effective response is crucial.

Can the Government Wait Years to Charge Me after Seizing My Device?

If your federal criminal investigation has lasted a while, you may be concerned that the government could wait indefinitely to charge you for your alleged crimes. This is a reasonable concern given the current state of federal digital forensics. If federal agencies are only processing computer cases every nine months, then it should be completely possible for these investigations to stretch for years.

But the truth is that the government cannot wait indefinitely. The clock of the statute of limitations keeps running even if federal examiners are bogged down with a forensic backlog. Unlike the time it takes to execute a search warrant or a subpoena, which is considered “discovery and evidence,” time that is spent awaiting imaging is not considered discovery. So, the time that it takes to execute digital forensic examination of seized devices is not an excuse for extending the statute of limitations.

When the Government Has no Right to Pursue Charges

The statute of limitations governs the time allowed for the government to pursue civil or criminal charges. While this date varies widely based on the alleged offenses, in most cases, the statute of limitations period is either five years or longer. Generally, in federal cases, the limitations period is five years, although this can vary depending on the offenses and circumstances involved.

Generally, 18 U.S.C. 3282 establishes a five-year limitation on criminal prosecutions. However, for offenses involving child pornography or other serious offenses, there are a different set of rules. Regardless of the specific limitations period, there is one important fact that you must understand: the limitations period begins to run from the date of the alleged offense, not from the date on which federal agents take you’s devices into their custody for an investigation. This means that, if a prosecutor seeks to prove that you obtained bank records on May 1st, 2020, and he or she is still looking at this data on August 1st, 2025, the clock of the statute of limitations is up, and the prosecutor can no longer file charges.

The second major limitation on the federal government’s ability to prosecute is that once it files charges (or once it arrests you), it must proceed to the trial at a reasonable pace. However, the clock starts once you have been arrested or formally charged, even though you are still an accused party. This means that while the clock may not have been running during your investigation, your case cannot drag on forever without any action being taken.

When Does the Clock of the Speedy Trial Act Begin?

The Sixth Amendment to the Constitution guarantees the right of a defendant to have a speedy trial. For those cases that have not been charged, you can make an claim that there is a constitutional violation before an indictment. But this claim is generally more difficult to successfully prove, because not only do you have to prove an actual violation, but you must also prove that the government purposefully delayed the investigation.

But, when you have been arrested or indicted, the Speedy Trial Act applies. While the 1974 Speedy Trial Act allows prosecutors to file indictments very late in federal investigations, the act ensures the defendant is not kept in custody for a very long time while awaiting trial. After the indictment is filed (or if you were arrested prior to indictment), your attorney will have the chance to request an early trial date. At this point, your case will proceed at the typical pace of a federal criminal case, and the defense will be able to request information and file preliminary motions.

When the Government Cannot Charge Me for the Alleged Crimes

When does the government’s ability to charge someone end? There are five variables to this question, and none of them are always the same. First, the alleged offenses will matter. Second, the venue of the prosecution will play a role. Third, the specific agency investigating the case will affect the timeline. Fourth, the experience of the prosecutors and the grand jury will play a role as well. And lastly, when the government has to rely on foreign evidence, this increases the time needed to investigate. None of these variables can be dismissed lightly.

If you are facing a federal criminal investigation, the first step is for your lawyer to ensure your rights are protected. This includes securing a copies of your search warrant and subpoenas. Once your attorney understands the scope of your investigation, they will be able to estimate how long the investigation will last and make an informed judgment.

Get Advice on Your Situation

If you want someone to look at the specifics of your case, Spodek Law Group handles federal criminal defense nationwide from New York and Los Angeles. The firm has been practicing since 1976 and its motto is simple: we owe loyalty to only you. Call 212-300-5196.