1. The defense expert will supply in advance, an external hard drive, factory new, for the purpose of the forensic examination. If the evidence to be copied to the examination drive is in raw format, then the examination drive must first be forensically wiped to prevent contamination of the evidence.
2. The law enforcement agency shall copy to the provided hard drive any FTK, EnCase, or other type of forensic image files that are an exact copy of the hard drive(s), CD- or DVD-ROM media, flash cards, floppy disks, smart media cards, or any other digital evidence seized and copied by law enforcement.
3. The law enforcement agency shall provide to the defense expert an unredacted copy of any computer forensic reports for the purpose of the forensic examination. Such unredacted reports shall be returned to the law enforcement agent at the end of each day’s examination period.
4. The expert will perform all of his work on the provided hard drive, using at his option, either his own forensic analysis equipment and software or forensic analysis equipment provided by the law enforcement agency.
5. At the end of the forensic examination session, the examination hard drive will be sealed in the presence of the defense expert and given to the law enforcement agent and kept in the custody of the police in case further review is needed at a future time.
6. When the expert sets up his case in his forensic analysis software, he will ensure that all temporary files, exports, and any other files that would normally be written out during the analysis will be written to the provided examination hard drive. The expert will show the law enforcement agent the setup of his analysis software for this case to support the above.
7. The law enforcement agency shall make such supervisory arrangements as deemed appropriate in accordance with the law enforcement agencies’ policies and procedures for the forensic examination of contraband material by a defense expert.
8. The expert will show to the law enforcement agent any items he wishes to copy or print, to provide to defense counsel as part of his analysis reporting, to ensure that no contraband images are copied or transferred.
9. The expert will be given a minimum window of six hours per day, scheduled in advance, to perform the analysis, with further analysis time to be provided if needed at a future date.
10. All items and information discovered by the expert are to be treated as attorney work product, and protected as such even though the law enforcement agent will review said documents and information for the presence of contraband.