Skip to main content
 

Part 9. Criminal Investigation

Chapter 4. Investigative Techniques

Section 11. Investigative Services

9.4.11 Investigative Services

Manual Transmittal

August 06, 2026

Purpose

(1) This transmits revised IRM 9.4.11, Investigative Services.

Material Changes

(1) Updated internal controls.

(2) Updated all IRM, form, and SharePoint references to quick links throughout the IRM.

(3) Removed SE:CI:CFS:CSD throughout the IRM.

(4) Subsection 9.4.11.3(3) removed “Each of these groups offers distinct services relating to evidence gathered in the course of an investigation.”

(5) Subsection 9.4.11.3.1 removed “Trial and Design Services, Multimedia and Deception Detection, and Scientific Services. Units in” and added “Scientific Services and Trial and Design Services.”

(6) Subsection 9.4.11.3.1.1(1) updated to current procedure.

(7) Moved subsection 9.4.11.3.1.3 to 9.4.11.3.1.2.1.

(8) Moved subsection 9.4.11.3.1.3.1 to 9.4.11.3.1.2.1.1.

(9) Moved subsection 9.4.11.3.1.5 to 9.4.11.3.1.7.3.

(10) Subsection 9.4.11.3.1.6(2)(b) updated form title to “Arrest and Institution Fingerprint Form.”

(11) Subsection 9.4.11.3.1.7.1 updated section title to “Types of Known Writing Exemplars.”

(12) Subsection 9.4.11.3.1.7.1.2 updated section title to “Collected Exemplars (Known Writing Exemplars).”

(13) Subsection 9.4.11.3.1.7.2(2) removed “see Unified Checklist or the Media and Publishing Services catalog page.”

(14) Subsection 9.4.11.3.1.8(3) removed “Form 13437, IRS CSD, can be located on the CI Connections page under Cyber and Forensic Services, on the CSD’s SharePoint site.”

(15) Subsection 9.4.11.3.1.9 updated section title to “Evidence Control.”

(16) Subsection 9.4.11.3.2(1) removed “ IRS CSD Request for Services (see Unified Checklist or the Media and Publication Services catalog page).”

(17) Added subsection 9.4.11.3.2(6) “Electronic evidence may be submitted on physical media as described above or may be submitted electronically through Foray Authenticated Digital Asset Management System (ADAMS). First time users may need to request access to Foray ADAMS through the Business Entitlement Access Request System (BEARS). A detailed guide to submitting electronic evidence files is available for reference on the CSD SharePoint site.”

(18) Subsection 9.4.11.3.3.1(2) removed “(see subsection 9.4.11.2.2) and updated "Laboratory” to “CSD”.

(19) Added subsection 9.4.11.4.1(5)(c) “Provide technical digital forensics services for the seizure of internet and cloud-based data for search warrants, subpoena/summons responses, and consent evidence production.”

(20) Added subsection 9.4.11.4.1(5)(h) “Provide assistance with the presentation of digital evidence at grand jury, trial, sentencing, and other court related hearings.”

(21) Added subsection 9.4.11.4.1(5)(i) “Testify at trial related to digital evidence.”

(22) Subsection 9.4.11.4.1(5)(j) updated to “Assist case agents with seizure and safeguarding of cryptocurrency and related digital assets.”

(23) Subsection 9.4.11.4.2(4)(a) updated to “Each senior analyst and CIFA successfully completes training as outlined in IRM 9.4.11.5.2 or may substitute an accredited industry specific certifications for BCERT with director’s approval.”

(24) Removed 9.4.11.4.2(4)(b) “Each Senior Analyst and CIFA attends annual advanced training courses to maintain a high level of proficiency and develop additional skills.”

(25) Subsection 9.4.11.4.2(4)(c) updated to “Each senior analyst and CIFA is required to obtain and maintain various digital forensics certifications to ensure their skills meet industry standards specific to the requirements listed in IRM 9.4.11.5.3 and their specific sub-discipline or team assignment within the DFL.

(26) Added subsection 9.4.11.4.2(4)(d) “Each senior analyst and CIFA attends annual advanced training courses to maintain a high level of proficiency and develop additional skills as outlined in IRM 9.4.11.7.2.”

(27) Added subsection 9.4.11.4.2(5)(f) “Validation of forensic tools and software”.

(28) Subsection 9.4.11.4.4 updated section title to “How to Request Services of Digital Forensics Field Services”.

(29) Added subsection 9.4.11.5 “Digital Forensics Personnel Qualifications, Training, and Certification Standards.”

(30) Added subsection 9.4.11.5.1 “Applicability.”

(31) Added subsection 9.4.11.5.2 “Mandatory Training Requirements.”

(32) Added subsection 9.4.11.5.3 “Certification Requirements.”

(33) Added subsection 9.4.11.5.4 “Mentorship and Career Progression.”

(34) Added subsection 9.4.11.6 “Evidence Handling Standards.”

(35) Added subsection 9.4.11.6.1 “Legal and Constitutional Standards.”

(36) Added subsection 9.4.11.6.2 “Acquisition and Authentication.”

(37) Added subsection 9.4.11.6.3 “Storage and Security.”

(38) Added subsection 9.4.11.6.4 “Analysis and Reporting”

(39) Added subsection 9.4.11.6.5 “Media Sanitization and Disposition”

(40) Added subsection 9.4.11.6.6 “Training Alignment.”

(41) Added subsection 9.4.11.7 “Continuing Education and Equipment Refresh.”

(42) Added subsection 9.4.11.7.1 “Continuing Education Requirements.”

(43) Added subsection 9.4.11.7.2 “Advanced Mandatory Annual Training.”

(44) Added subsection 9.4.11.7.3 “Equipment Refresh.”

(45) Added subsection 9.4.11.8 “Compliance and Documentation.”

(46) Added subsection 9.4.11.8.1 “Training Documentation.”

(47) Added subsection 9.4.11.8.2 “Certification Documentation.”

(48) Added subsection 9.4.11.8.3 “Compliance Monitoring.”

(49) Added subsection 9.4.11.9 “Summary and Implementation.”

(50) Editorial changes made throughout the IRM did not result in substantive changes but contributed to clarity of the subject matter.

Effect on Other Documents

This IRM supersedes IRM 9.4.11 dated May 24, 2024.

Audience

Criminal Investigation

Effective Date

(08-06-2026)

Gary A. Shapley, Jr.
Deputy Chief, Criminal Investigation
for
Jarod J. Koopman
Chief, Criminal Investigation

9.4.11.1 (08-06-2026)

Program Scope and Objectives

  1. Purpose: This section relates to the investigative services available within Criminal Investigation to provide special agents assistance in conducting criminal investigations and associated litigation activities.
  2. Audience: All Criminal Investigation employees.
  3. Policy Owner: Executive Director, Cyber and Forensic Services.
  4. Program Owner: Director, Cyber and Forensic Services.
  5. Primary Stakeholders: Director, Digital Forensics and Director, Workforce Development.
  6. Contact Information: To make changes to this IRM section *CI-HQ-IRM.
  7. Goal: To provide special agents with assistance in conducting criminal investigations and associated litigation activities.
9.4.11.1.1 (08-06-2026)

Background

  1. The authority to enforce federal laws is derived from a variety of statutes. These statutes may assign the enforcement of any given law to a particular department such as the Treasury Department, an agency of a department such as the IRS, or simply that the enforcement falls to the legal arm of the government, the Department of Justice.

  2. Criminal Investigation has Operational and Investigative Strategies. Criminal Investigation’s strategies are classified in terms of:

    • Initiatives in which Criminal Investigation participates.
    • Priorities within the program area.
    • Schemes encountered in the program areas.
    • Other situations to which the special agent should be sensitive when conducting an investigation.

     

  3. The sources providing investigative services include the following:

    1. Center for Science and Design.
    2. Digital Forensics.
    3. Field Office Resources, including Investigative Analyst; Tax Fraud Investigative Assistant; and Compliance Support Assistant.
    4. Scheme Development Centers.

     

9.4.11.1.2 (12-18-2018)

Authority

  1. See IRM 9.1.2, Authority, for the delegated authority relating to IRM 9.4.11, Investigative Services.
9.4.11.1.3 (08-06-2026)

Roles and Responsibilities

  1. The Executive Director, Cyber & Forensic Services is responsible for:

    1. Providing program oversight.
    2. Maintaining and overseeing updates to this IRM.
    3. Ensuring internal control content is complete, accurate, and reviewed annually.
    4. Reviewing and approving any updates to this IRM before they are published.

     

  2. The Directors of Cyber & Forensic Services and Workforce Development are responsible for:

    1. Updating this IRM when the content is no longer accurate, outdated, or duplicated.
    2. Adding new or revising legislation, laws, regulations, programs, or processes.
    3. Ensuring the IRM provides reliable information for decision making and quality assurance.
    4. Incorporating interim guidance into the next revision of this IRM prior to the expiration date.

     

  3. It is the responsibility of all Criminal Investigation employees to protect taxpayer confidentiality and to understand when access to or disclosure of taxpayer information is authorized by law. Information regarding disclosure of confidential tax information under the Freedom of Information Act can be found in IRM 11.3.13, Freedom of Information Act and information on the Privacy Act can be found in IRM 11.3.5.4, Privacy Act Requests.
9.4.11.1.4 (08-06-2026)

Program Management and Review

  1. The Directors of Center for Science and Design, Digital Forensics, and Workforce Development will review this IRM annually for procedural, operational, and editorial changes ensuring consistent application of policy, procedures, and tax law while protecting taxpayers’ rights.
9.4.11.1.5 (08-06-2026)

Program Controls

  1. The Directors of Center for Science and Design, Digital Forensics, and Workforce Development will review their program and ensure employee compliance with all applicable elements of this IRM and utilize their business units efficiently and effectively to accomplish the strategies and mission of IRS and Criminal Investigation.
9.4.11.1.6 (08-06-2026)

Acronyms

  1. The table lists commonly used acronyms and their definitions:

    AcronymsDefinition
    ADAMSAuthenticated Digital Asset Management System
    ASACAssistant Special Agent In Charge
    BCERTBasic Computer Evidence Recovery Training
    CFSCyber and Forensic Services
    CIFAComputer Investigative Forensic Analysts
    CISComputer Investigative Specialist
    CSACompliance Support Assistant
    CSDCenter for Science and Design
    DFDigital Forensics
    DFFSDigital Forensics Field Services
    DFLDigital Forensics Lab
    DNADeoxyribonucleic Acid
    FBIFederal Bureau of Investigation
    IAInvestigative Analyst
    IPSInvestigative Professional Staff
    RDFLRegional Digital Forensics Lab
    SASpecial Agent
    SACSpecial Agent In Charge
    SIASupervisory Investigative Analyst
    SOPStandard Operating Procedure Groups 40/41/42
    SSASupervisory Special Agent
    TFIATax Fraud Investigative Assistant
9.4.11.2 (08-06-2026)

Related Resources

  1. IRM 11.3.5.4, Privacy Act Requests.
  2. IRM 11.3.13, Freedom of Information Act.
9.4.11.3 (08-06-2026)

Center for Science and Design

  1. The Center for Science and Design (CSD) formerly known as the "National Forensic Lab" is a section under the office of Cyber and Forensic Services (CFS) business unit. The CSD is comprised of separate and distinct units, each of which offers services relating to evidence gathered in the course of an investigation.
  2. The CSD is headquartered in Chicago, Illinois, with additional examiners located in a few other cities across the nation.
  3. The CSD maintains up-to-date contact information and forensic reference material on the CSD SharePoint site. The CSD SharePoint site should be reviewed for additional information that may be utilized during investigations. The following subsections will briefly describe the individual units within the CSD, and the services provided by each team. The subsections also detail how to request and obtain services provided by the CSD.
9.4.11.3.1 (08-06-2026)

Center for Science and Design Organization and Services

  1. The CSD is made up of two sections, Scientific Services and Trial and Design Services, and each section delivers specific services. There is detailed information on the CSD SharePoint site that should be reviewed early on in an investigation to determine if the CSD may be useful. The CSD is organized as follows:

    CSD SectionCSD Services
    Trial and Design Services
    • Trial Infographics
    • Criminal Investigation (CI) Design Services
    • Special Projects
    Scientific Services
    • Questioned Document Examination
    • Chemistry Examination
    • Latent Print Examination
    • Deoxyribonucleic Acid (DNA) Collection
    • Audio, Visual, and Image Analysis
    • Polygraph Examination

     

9.4.11.3.1.1 (08-06-2026)
Audio, Video, and Image Analysis
  1. Audio, Video, and Image (AVI) analysis examiners assist IRS-CI cases with advanced restoration, enhancement, metadata analysis, and processing of evidentiary recordings.
  2. Using forensic software, examiners are able to apply non-destructive techniques to better hear and/or see events as they occurred. Examiners aim to clarify recordings and to preserve speech quality and recording authenticity. They also aim to clarify photographs or shot footage while preserving the integrity of the original image or video.
9.4.11.3.1.2 (05-05-2022)
Polygraph Examination
  1. Polygraph examiners conduct examinations to test credibility issues which may arise before, during, or after the completion of an investigation.
  2. Polygraph examiners also evaluate examinations conducted by operators outside the IRS.
9.4.11.3.1.2.1 (08-06-2026)
Suitability of a Polygraph Examination
  1. A polygraph examination may be used to determine the reliability of information provided by informants, subjects, witnesses, and cooperating defendants. A polygraph examination may also be conducted pursuant to a plea agreement in order to determine if the defendant is cooperating fully with the government.
  2. A polygraph examination should be used selectively as an investigative tool. A qualified polygraph examiner should be directly consulted by the special agent (SA) whenever a polygraph is considered. A qualified examiner is trained to evaluate the suitability of the polygraph technique as requested by the SA.
9.4.11.3.1.2.1.1 (08-06-2026)
Legal Admissibility of the Results of a Polygraph
  1. The legal admissibility of the results of a test (deception indicated, no deception indicated, inconclusive, or no opinion) varies by jurisdiction. However, statements, admissions, and confessions obtained during the examination process are generally admissible in court.
9.4.11.3.1.3 (08-06-2026)
DNA Collection
  1. CSD Examiners can attempt to collect DNA from items of evidence.
  2. Requests for DNA collection may be made via Form 13437, IRS Center for Science and Design Request for Services.
  3. Collection of DNA samples does not necessarily require analysis of the sample. Suitability for subsequent DNA analysis will be determined on a case-by-case basis with the evaluation of the evidence in conjunction with documented communication with the submitter.
9.4.11.3.1.4 (08-06-2026)
Latent Print Unit
  1. Latent print examiners process evidence and compare latent finger and palm prints found on evidence to fingerprint and palm print cards of known subjects. The use of new techniques has enabled the development of previously undetectable prints. Latent print examiners can search for unidentified latent prints through computerized fingerprint and palm print databases throughout the country. Review the CSD SharePoint site for additional technical information.

  2. When a subject is required to provide handwriting exemplars and/or to be photographed, SAs should also obtain fingerprints and palm prints of the subject and submit them with the evidence to be examined.

    1. A full set of known prints consists of clearly and completely recorded fingerprints and palm prints, including the area referred to as the "writer’s palm." The writer’s palm is that area on the side of the palm which normally rests on the paper when writing.
    2. Fingerprints should be recorded on Form FD-249, Arrest and Institution Fingerprint Form. Form FD-249, with the field office’s originating agency identifying (ORI) Number, may be obtained directly from the Federal Bureau of Investigation (FBI).
    3. Fingerprints and palm prints are also taken by a method called live-scan or direct electronic fingerprinting/palm printing. This method records prints digitally into a computer database after fingerprints/palm prints are rolled/recorded on a piece of glass of a computer-driven scanner.
    4. If an agent is unable to roll/record the subject’s prints, fingerprints and palm prints may be obtained from the FBI identification division, which contains civilian and criminal records. The FBI number of an individual with a criminal history may be found in the National Crime Information Center (NCIC). This number is necessary for ordering purposes. When using the services of the CSD to obtain a set of prints, SAs must provide the person’s FBI number.
    5. Although a set of recorded fingerprints/palm prints might be considered classifiable, that does not mean they are fully comparable or identifiable to latent fingerprints/palm prints.
    6. The utmost care must be utilized to ensure that subjects do not handle any original documents relating to the investigation during interviews, etc. This would negate any subsequent examination for latent prints on those documents. If it is appropriate to preserve the evidence for examination, the evidence should be placed in document protectors before it is shown to the subjects.

     

9.4.11.3.1.5 (08-06-2026)
Questioned Document and Chemistry Examinations

  1. The Questioned Document and Chemistry Examiners conduct analysis and comparisons of questioned and known documentary evidence. This includes handwriting, hand printing, numerals, mechanical impressions, and ink and paper. Examiners also decipher obliterations and alterations and can develop indented writing on documents. Burned or torn/shredded documents may be submitted; however, SAs should contact the laboratory for specific instructions and guidance before handling and/or submitting burned or torn/shredded documents.

    Note:

    It is very important not to add any indentations to the questioned documents during their collection, handling, or shipping. The documents should be put in plastic sleeves or document protectors for handling. Never place other papers on top of the evidence and then write on them. The transmittal envelope should be addressed before the documents are placed inside.

     

  2. Exemplars should be obtained whenever SAs become aware that the authenticity or origin of a document may be questioned. It is critical that SAs obtain original known exemplars before submitting a request. The results of the examinations performed by the CSD depend largely on the quality of the known writing that is submitted for comparison.
9.4.11.3.1.5.1 (08-06-2026)
Types of Known Writing Exemplars
  1. There are two types of exemplars: requested and collected. Whenever possible, both types should be submitted.
9.4.11.3.1.5.1.1 (05-05-2022)
Requested Exemplars (Known Writing Exemplars)
  1. Requested exemplars contain repetitions of all of the letters and letter combinations that are present in the text of the questioned documents.
  2. Requested exemplars are gathered during the course of an investigation as a result of a request, summons, or subpoena of the suspected writer.
  3. A summons or a subpoena may be issued to a subject for the purpose of providing handwriting exemplars. Compulsion of handwriting exemplars is neither a search nor seizure subject to Fourth Amendment protections, nor testimonial evidence protected by the Fifth Amendment privilege against self-incrimination. Serving a summons on a subject for the purpose of taking exemplars is within the authority of 26 USC 7602. This action does not violate the Fifth Amendment rights of a subject, or policies established by Congress because handwriting exemplars are deemed identifying physical characteristics. The CSD SharePoint site has more information or contact examiners at the CSD on requesting known writing exemplars.
9.4.11.3.1.5.1.2 (08-06-2026)
Collected Exemplars (Known Writing Exemplars)
  1. Collected exemplars consist of normal course-of-business records such as personal papers, canceled checks, rent applications, receipts, school documents, etc. Collected exemplars are naturally written (no disguise) and they are an excellent source of known writing when comparing writings.
9.4.11.3.1.5.2 (05-05-2022)
Comparisons of Handwriting, Printing and Numeral Exemplars

  1. SAs should contact Questioned Document and Chemistry Examiners at the CSD prior to obtaining exemplars. SAs should use the following guidelines when obtaining exemplars:

    1. Exemplars should be original documents known to have been written by the person suspected of writing the questioned document.
    2. Exemplars should contain repetitions of all of the letters and letter combinations that are present in the text of the questioned documents.
    3. Exemplars should approximate the questioned writing conditions (i.e., if handwritten, get known handwriting; if upper-case hand printed, get known upper-case hand printing, etc.).
    4. Exemplars should be made with a similar writing instrument, on similar paper, and should include, as nearly as possible, the full text of the document questioned.

     

  2. In addition to getting exemplars containing comparable repetitions of the questioned text, SAs should use Form 6540 (EN-SP) to obtain a general sample of an individual’s writing.
9.4.11.3.1.5.2.1 (05-05-2022)
Mechanical Impression Comparisons
  1. Examinations and comparisons of mechanical impressions, including typewriter impressions and rubber stamp impressions can be conducted. Identifications are based on individual defects usually caused by wear or damage.
9.4.11.3.1.5.2.2 (05-05-2022)
Typewriter Exemplars

  1. If a typewriter is located, the questioned document and chemistry examiners at the CSD should be contacted to determine if the typewriter should be submitted to the laboratory or if exemplars should be taken from it.

    1. If the machine is equipped with a readable carbon ribbon, the ribbon should be removed, protected, and submitted. The team has the capability of transcribing the text found on readable carbon ribbons.

     

9.4.11.3.1.5.2.3 (05-05-2022)
Printer Exemplars
  1. If a printer is located, the questioned document and chemistry examiners at the CSD should be contacted before submitting it or exemplars from it to the laboratory.
9.4.11.3.1.5.2.4 (05-05-2022)
Rubber Stamp Exemplars
  1. If available, the known rubber stamp should be submitted along with the questioned documents bearing rubber stamp impressions. The document examiner will examine the rubber stamp before producing exemplars. No attempt should be made to clean the rubber stamp before submitting it to the laboratory.
9.4.11.3.1.5.3 (08-06-2026)
Torn/Shredded Paper
  1. Torn/shredded paper evidence should not be taped or glued together prior to submission to the laboratory. The examiner will evaluate the characteristics of the torn/shredded edges to reconstruct the documents. If the torn/shredded documents are found in the garbage or a shredder, the SA should attempt to maintain the integrity of the torn/shredded documents by handling them as little as possible.
9.4.11.3.1.5.4 (05-05-2022)
Charred Documents
  1. Charred or burned documents may be examined and imaged with the aid of various light sources. Many times, what is not visible under ordinary light may be deciphered and recorded using specialized light sources. Charred or burned documents should be placed in protective packaging and submitted, as soon as possible to the laboratory. SAs should contact the laboratory for specific instructions and guidance before handling charred or burned paper evidence.
9.4.11.3.1.6 (08-06-2026)
Trial and Design Services
  1. Visual Information Specialists design courtroom infographics and data visualizations based on supporting evidence and statistical information provided by the trial team during consultation. All products are provided to customers after a thorough product development process. Methods used in the design of graphics include consultations and correspondence, as well as review of evidence and charges. The types of graphics vary from bar charts, line, pie, maps, timeliness, link analysis, computations, element of the offense charts. Ongoing communications and support is provided throughout the trial and product development.
  2. Designers collaborate with CI counterparts and leadership to create print and digital marketing material in accordance with the CI branding standards. Products include single and multi-page documents, interactive documents, recruitment material, standardized templates and many other specialized design projects.
  3. Form 13437, IRS Center for Science and Design Request for Services, should be submitted a minimum of 30 days before to allow for consultation and to provide sufficient time to discuss the evidence and documentation that will assist in the preparation of the graphics.
9.4.11.3.1.7 (08-06-2026)
Evidence Control
  1. Evidence Control receives all requests for the CSD and tracks these requests as they move through the CSD between services. Evidence Control is responsible for ensuring the integrity of the evidence when it comes in and leaves the laboratory.
9.4.11.3.2 (08-06-2026)

How to Request Services of the Center for Science and Design

  1. SAs should initiate requests for any service offered by the CSD using Form 13437. Information required on the form includes the investigation name and number, type of request, type of investigation, investigation synopsis, description of the submitted evidence, and the submitter’s contact information.
  2. Whenever possible, original evidence should be submitted for examination. If copies are the only available evidence they can be submitted; however, the examination may be limited. SAs should keep copies of the original evidence submitted to the CSD.

  3. Form 13437 includes instructions on how to fill out the form and how to package, seal and ship the evidence. If an expedited examination is needed, the SA should indicate the reason and/or pending court or grand jury date. SAs should call and advise the team in advance of an exigent request.

    Note:

    All evidence should be secured from the time the evidence is obtained through the course of the investigation. Before submitting evidence to the laboratory, it is recommended that SAs call the laboratory and/or review the CASE web page under Forensic Lab/Evidence Control.

     

  4. Requests for services and evidence for any of the CSD teams should be sent to the following address:

    Internal Revenue Service
    Criminal Investigation Division
    Evidence Control, Center for Science & Design
    525 W. Van Buren St., Suite 400
    Chicago, Illinois 60607

     

  5. SAs should submit the request for services and the evidence as soon as they realize their investigation may benefit from the services offered by the CSD.
  6. Electronic evidence may be submitted on physical media as described above or may be submitted electronically through Foray Authenticated Digital Asset Management System (ADAMS). First time users may need to request access to Foray ADAMS through the Business Entitlement Access Request System (BEARS). A detailed guide to submitting electronic evidence files is available for reference on the CSD SharePoint site.
9.4.11.3.2.1 (05-05-2022)
Use of a Non-IRS Laboratory
  1. In situations where the use of a non-IRS laboratory is being considered, the Special Agent in Charge (SAC) of the requesting field office may contact the CSD Director for recommendations and guidance based on services needed and/or turn-around-time.
9.4.11.3.3 (05-05-2022)

Role of the Examiners

  1. Examiners prepare reports based on their examinations and conclusions. They are available to testify in court or other judicial proceedings regarding their conclusions.
9.4.11.3.3.1 (08-06-2026)
Travel by the Examiners
  1. In situations where it is necessary for examiners to travel to a field office to perform on-site examinations and/or consultations, travel must be coordinated with the specific examiner and CSD management. The examiners are also available to travel to the field offices for Continuing Professional Education (CPE) presentations.
  2. Requests for travel by CSD examiners to perform on-site examinations should be submitted on Form 13437. Requests for examiners to participate in CPE presentations should be made in writing (either memorandum or e-mail) by the SAC to the CSD Director.
  3. The cost of the services provided by the CSD is not charged to the requesting field office as the cost is paid using the CSD’s budget. The cost of CSD services may be charged to the defendant if the judge orders the defendant to pay court costs.
9.4.11.3.4 (08-06-2026)

Evaluation of Services

  1. At the completion of a case, SAs will receive and are asked to complete Form 13436, IRS Center for Science and Design Evaluation of Services. The evaluation will enable the CSD to meet laboratory accreditation requirements, while maintaining quality services and keeping apprised of the field offices’ needs.
9.4.11.4 (05-05-2022)

Digital Forensics

  1. Digital Forensics (DF), formerly known as Electronic Crimes, is a section within CFS, Forensic Services. DF is comprised of two units:

    1. Digital Forensics Field Services (DFFS), and
    2. Digital Forensics Lab (DFL).

     

9.4.11.4.1 (08-06-2026)

Digital Forensics Field Services

  1. DFFS is led by an Associate Director(s).
  2. Each DFFS group is comprised of one Supervisory Special Agent (SSA), a mix of 1811 Computer Investigative Specialist (CIS), 1801 Computer Investigative Forensic Analysts (CIFA), and contract employees.
  3. Each DFFS group is located in Regional Digital Forensics Lab (RDFL) and/or in smaller remote labs throughout the country.

  4. DFFS personnel are trained in digital forensics methodology to ensure digital evidence is acquired, authenticated, analyzed, and reported in a forensically sound manner according to established forensic best practices.

    1. Each CIS and CIFA successfully completes Basic Computer Evidence Recovery Training (BCERT), a six-week course that provides baseline digital forensics training, and Basic Mobile Forensics, a two-week course that provides baseline mobile forensics training. Externally hired CIFAs may substitute a combination of education, industry experience, and accredited industry specific certifications for BCERT with director approval.
    2. Each CIS and CIFA attends annual advanced training courses to maintain a high level of proficiency and develop additional skills.
    3. Each CIS and CIFA is required to obtain and maintain various digital forensics certifications to ensure their skills meet industry standards.

     

  5. DFFS provides vital services to support criminal investigations:

    1. Assist case agents with affidavit writing and review.
    2. Provide technical digital forensics services at search warrants, for subpoena/summons responses, and during consent evidence production.
    3. Provide technical digital forensics services for the seizure of internet and cloud-based data for search warrants, subpoena/summons responses, and consent evidence production.
    4. Ensure digital evidence is obtained, validated, and maintained in a forensically sound manner.
    5. Conduct analysis on digital evidence to locate and properly interpret potential evidence.
    6. Report to case agent on results of analysis.
    7. Assist with discovery production by providing validated copies of digital evidence obtained throughout the investigation.
    8. Provide assistance with the presentation of digital evidence at grand jury, trial, sentencing, and other court related hearings.
    9. Testify at trial related to digital evidence.
    10. Assist case agents with seizure and safeguarding of cryptocurrency and related digital assets.
    11. Other digital forensics tasks as required.

     

  6. It is vital to request DFFS services as early as possible in the investigation when digital evidence is anticipated. Affidavit review must occur prior to final approval to ensure legal requirements are met, all investigative needs are addressed, and no undue restrictions are present. DF requires extensive planning, research, and resources prior to enforcement actions.
9.4.11.4.2 (08-06-2026)

Digital Forensics Lab

  1. DFL is led by an Associate Director.
  2. Each DFL group is comprised of one SSA and a mix of 1811 Senior Analysts and 1801 CIFAs, Computer Scientists, contractors, and support staff.
  3. The DFL is headquartered in Woodbridge, Virginia. Some DFL personnel are located in a RDFL or in a smaller remote lab throughout the country.

  4. DFL personnel are trained in digital forensics methodology to ensure digital evidence is acquired, authenticated, analyzed, and reported in a forensically sound manner according to forensic best practices.

    1. Each senior analyst and CIFA successfully completes training as outlined in IRM 9.4.11.5.2 or may substitute an accredited industry specific certifications for BCERT with director’s approval.
    2. Each senior analyst and CIFA is required to obtain and maintain various digital forensics certifications to ensure their skills meet industry standards specific to the requirements listed in IRM 9.4.11.5.3 and their specific sub-discipline or team assignment within the DFL .
    3. Each senior analyst and CIFA attends annual advanced training courses to maintain a high level of proficiency and develop additional skills as outlined in IRM 9.4.11.7.2.

     

  5. DFL assists DFFS as needed to provide support in criminal investigations.

    1. Provide technical digital forensics services at search warrants, for subpoena/summons responses, and during consent evidence production.
    2. Ensure digital evidence is obtained, validated, and maintained in a forensically sound manner.
    3. Conduct analysis on digital evidence to locate and properly interpret potential evidence.
    4. Assist case agents with seizure of digital assets.
    5. Advanced support through DFL Teams as needed.
    6. Validation of forensic tools and software.
    7. Other digital forensics tasks as required.

     

  6. DFL provides advanced support to DFFS through the following DFL Teams.

    DFL TeamAdvanced Support
    Cyber Team
    • Digital asset seizures
    • Cloud investigations
    • Network intrusions
    • Pent/Trap orders
    • Title III Intercepts
    • Dark Web investigations
    • Website captures
    Data Recovery Team
    • Hard drive recovery
    • Encryption
    • Password cracking
    • Specialized imaging
    Hardware Team
    • Selection and purchase of DF equipment
    • Testing and validation of equipment
    • Maintain inventory records
    Mac Team
    • Mac Imaging
    • Apple specific tools
    • Apple cloud analysis
    Mobile Team
    • Mobile forensics tools
    • Advanced mobile device extraction
    • Cloud analysis
    Programming/Databases
    • Databases
    • Linux based forensics
    • DF created forensic programs
    Software
    • RAM captures
    • Windows forensics
    • Selection and maintenance of DF software
    • Testing and validation of software
    Systems
    • Network forensics
    • Server forensics
    • Virtualization

  7. In addition to the DFL teams above, DF has several DFL Teams which support the infrastructure of DF.

    DFL TeamsDF Infrastructure Support
    Training and Education
    • Coordinate DF basic and advanced DF training
    • Develop basic and advanced DF training curricula
    • Certification maintenance and renewal
    Quality Assurance
    • Creation and maintenance of DF Standard Operating Procedures (SOP) 40/41/42
    • Ensure established procedures conform with industry practices for accreditation
    • Create and maintain methodologies for DF proficiency testing
    • Create and maintain protocols for DF technical reviews
    • Monitor DF training and certification compliance
    Digital Forensics Environment
    • Technical lead for ECE
    • Lead Area CIS cadre lead
    • Develop and deploy ECE training
    • Monitor resources
    Investigative Technology
    • Research and select emerging technology to support CFS in furtherance of CI’s mission.
    • Engineer and deploy broad scale technology solutions for CFS.
    • Maintain broad scale technology solutions for CFS.
9.4.11.4.3 (05-05-2022)

Evidence Control at Digital Forensics

  1. DF employees will maintain proper chain of custody for all items in DF custody as per DF Standard Operating Procedures.
  2. DF employees will maintain custody of digital devices as needed during the acquisition phase. Once acquisition is complete, custody will be transferred to the case agent. Any exception will be approved by the SSA-CIS and recorded in the case file.
9.4.11.4.4 (08-06-2026)

How to Request Services of Digital Forensics Field Services

  1. Case agents should initiate requests for service using Form 10908, Computer Investigative Specialist Request for Assistance.
  2. Case agents should initiate requests as soon as practicable upon determining a search warrant will be executed, a consent involving digital evidence will be scheduled, a digital asset seizure is likely, or a search warrant or subpoena for digital evidence will be issued.
  3. Form 10908 will be submitted through SSA to SSA-CIS for assignment.
  4. It is vital to request services as early as possible in the investigation when digital evidence is anticipated. DF requires planning, research, and resources prior to enforcement actions.
9.4.11.4.5 (05-05-2022)

How to Request Services of Digital Forensics Lab

  1. If a DF employee is assigned to an investigation, no additional form is required. If not, case agents should initiate requests for DFL service using Form 10908, Computer Investigative Specialist Request for Assistance, through the SSA-CIS.
  2. DFFS will initiate requests for DFL assistance through internal request processes. DFL SSA or Associate Director, DFL will assign an appropriate Team and DFL personnel to assist on the case.
9.4.11.4.5.1 (08-06-2026)
How to Request Digital Forensics Services for Digital Asset Seizures
  1. DF has set up a digital asset shared mailbox, *CI-HQ-CFS-DF-CryptoSeizure, specifically for digital asset seizures.
9.4.11.5 (08-06-2026)

Digital Forensics Personnel Qualifications, Training, and Certification Standards

  1. Purpose:

    1. This section establishes mandatory training, certification, and digital evidence handling standards for personnel assigned to DFFS and the DFL within CI.
    2. DF is a critical investigative capability and has become central to the success of CI operations. Personnel routinely support investigations involving forensic recovery from complex systems—physical and cloud-based, encrypted and ephemeral—as well as mobile device analysis, volatile memory capture, and digital asset seizure. The increasing complexity of digital evidence requires personnel to maintain proficiency in specialized tools, methodologies, and legal standards.
    3. Formalizing and expanding training and certification requirements ensures personnel are equipped to meet operational demands, maintain evidence integrity, and support the admissibility of digital evidence in judicial proceedings.

     

9.4.11.5.1 (08-06-2026)

Applicability

  1. This section applies to:

    1. GS-1811 CIS.
    2. GS-1801 CIFA.

     

9.4.11.5.2 (08-06-2026)

Mandatory Training Requirements

  1. DF personnel must complete the following training programs according to their role and tenure:

    TrainingDescriptionTimeline
    CompTIA A+Entry-level IT certification covering hardware, software, networking, and security.SA-CIS: Prior to conversion; CIFA; Within 3 months of hire
    BCERTBasic Computer Evidence Recovery Training (6 weeks)SA-CIS: Prior to conversion; CIFA: Within 1 year
    BMFBasic Mobile Forensics (1 week)Within 1 year of BCERT completion
    MACMacintosh ForensicsRequired by end of 2nd year
    ACERTAdvanced Computer Evidence Recovery Training (2 weeks)Between years 1-3; repeated every 4 years
    AMFAdvanced Mobile ForensicsRequired by end of 4th year; repeated as needed
    BCFEBasic Computer Forensic Examiner - prerequisite for CFCE certificationRequired prior to beginning CFCE certification
    AMATAdvanced Mandatory Annual Training - forensic and legal topicsRequired annually if offered

    Note:

    Waivers may be granted by the Director, DF under documented circumstances.

     

9.4.11.5.3 (08-06-2026)

Certification Requirements

  1. Personnel must obtain and maintain the following certifications:

    CertificationDescriptionTimeline
    CompTIA A+Required for entry into BCERTSee training timeline above
    CFCE (Certified Forensic Computer Examiner)IACIS certification following BCFE course and 5-month processRequired by end of 4th year; renewed every 3 years
    X-PERT (X-Ways)Required for specialized subdisciplinesBased on operational needs
    Other CompTIA (Net+, Security+)Required for specialized subdisciplinesBased on operational needs
    Other Forensic Certifications (e.g., CISSP, CCE)Required for specialized subdisciplinesBased on operational needs

    Note:

    DF will fund mandatory certification costs and may fund specialized certifications based on budget availability.

     

9.4.11.5.4 (08-06-2026)

Mentorship and Career Progression

  1. New examiners will participate in a structured mentorship program lasting up to 2 years. Progress will be tracked via a standardized Progress Document to be maintained in Laboratory Information Management System (LIMS). Completion of mentorship is required before conducting independent forensic analysis.
  2. Where feasible, examiners should be exposed to a variety of forensic tasks under the supervision of experienced personnel. SSA-CISs are encouraged to assign new examiners to diverse search warrants, forensic analysis assignments, and temporary working groups to broaden their experience and methodology exposure.
9.4.11.6 (08-06-2026)

Evidence Handling Standards

  1. DF personnel shall follow standardized procedures for the acquisition, authentication, analysis, storage, and disposition of digital evidence. These procedures are designed to ensure compliance with applicable legal, regulatory, and technical standards, and to support the admissibility of evidence in federal judicial proceedings.
9.4.11.6.1 (08-06-2026)

Legal and Constitutional Standards

  1. Digital evidence handling must comply with:

    1. The Sixth Amendment to the U.S. Constitution.
    2. The Federal Rules of Evidence, including:
      -Rule 902(14): Self-authentication of electronic evidence.
      -Rule 901: Authentication.
      -Rule 702: Expert testimony.
      -Rule 402: Relevance.
    3. The Federal Rules of Criminal Procedure, Rule 16: Disclosure obligations.
    4. Requirements specific to the jurisdiction where the activity is taking place.

     

9.4.11.6.2 (08-06-2026)

Acquisition and Authentication

  1. Digital evidence shall be acquired using validated forensic tools and procedures that preserve data integrity. All acquisitions must be documented to establish a clear and defensible chain of custody. Authentication must meet the standards outlined in Rule 901 and IRS-CI DF SOPs.
9.4.11.6.3 (08-06-2026)

Storage and Security

  1. Digital evidence shall be stored in encrypted, access-controlled environments. Storage systems must include audit capabilities and comply with IRS-CI security protocols. Access shall be restricted to authorized personnel only.
9.4.11.6.4 (08-06-2026)

Analysis and Reporting

  1. All forensic analysis shall be conducted using standardized methodologies consistent with Scientific Working Group on Digital Evidence (SWGDE) best practices. Reports shall be prepared in accordance with IRS-CI guidelines and must support admissibility under Rule 702.
9.4.11.6.5 (08-06-2026)

Media Sanitization and Disposition

  1. When digital evidence is no longer required, it shall be sanitized or disposed of in accordance with NIST SP 800-88 Rev. 1 guidelines. Documentation of sanitization or destruction shall be maintained in accordance with IRS-CI retention policies.
9.4.11.6.6 (08-06-2026)

Training Alignment

  1. All evidence handling procedures shall be aligned with the training provided by the Treasury Computer Forensic Training Program (TCFTP) to ensure consistency across IRS-CI and partner agencies.
9.4.11.7 (08-06-2026)

Continuing Education and Equipment Refresh

  1. DF personnel shall participate in ongoing training and professional development to maintain technical proficiency, certification compliance, and operational readiness. Continuing education is essential to ensure examiners remain current with evolving technologies, forensic tools, investigative methodologies, and meet applicable quality assurance and accreditation standards.
9.4.11.7.1 (08-06-2026)

Continuing Education Requirements

  1. All personnel must complete annual continuing education hours sufficient to maintain required certifications. Training shall be documented in accordance with IRS-CI DF SOPs and recorded in the Laboratory Information Management System (LIMS).
9.4.11.7.2 (08-06-2026)

Advanced Mandatory Annual Training

  1. Personnel shall attend Advanced Mandatory Annual Training (AMAT) when offered. AMAT includes instruction on advanced forensic techniques, legal updates, and IRS-CI specific investigative applications.
9.4.11.7.3 (08-06-2026)

Equipment Refresh

  1. Advanced training may include issuance of updated forensic hardware and software. Equipment distribution should be coordinated with training delivery and managed by DF.
9.4.11.8 (08-06-2026)

Compliance and Documentation

  1. DF personnel shall maintain accurate and timely records of all training, certifications, and professional development activities.
9.4.11.8.1 (08-06-2026)

Training Documentation

  1. All completed training shall be documented in LIMS within 30 calendar days of completion and recorded in the appropriate personnel file.
9.4.11.8.2 (08-06-2026)

Certification Documentation

  1. All certifications, including initial and renewal, shall be recorded in LIMS and the appropriate personnel file within 30 calendar days of issuance or renewal.
9.4.11.8.3 (08-06-2026)

Compliance Monitoring

  1. Failure to meet mandatory requirements may result in:

    1. Reassignment from the SA-CIS or CIFA role,
    2. Performance rating impacts,
    3. Review by DF leadership.

    Note:

    Exceptions or extensions must be approved by the Director, DF, and documented accordingly.

     

9.4.11.9 (08-06-2026)

Summary and Implementation

  1. The training, certification, and operational standards outlined in this section are essential to the continued success of the DF program. These requirements ensure that DF personnel maintain technical proficiency, legal compliance, and investigative readiness necessary to support IRS-CI’s mission.
  2. All CIS and CIFA personnel must meet the mandatory qualifications and timelines as defined in this document. Implementation shall be managed by DF leadership and documented through LIMS and the appropriate personnel file. Exceptions must be approved by the Director, DF.
  3. These requirements are effective immediately upon publication and apply to all current and future personnel assigned to DF roles.
9.4.11.10 (08-06-2026)

Field Office Investigative Professional Staff Group 40/41/42

  1. The Investigative Analyst (IPS) is comprised of Investigative Analysts (IA) and Tax Fraud Investigative Assistants (TFIA), who are managed by a Supervisory Investigative Analyst (SIA).
  2. The IPS provides investigative support to field office investigative activities.
9.4.11.10.1 (08-06-2026)

Investigative Analyst

  1. The IA assists in the identification of noncompliance with tax laws and supports ongoing criminal investigations by researching, collecting, analyzing, and evaluating raw data. The IA is available to support any investigation in the field office. For more information pertaining to IA assistance refer to Exhibit 9.4.11-1, Standard Operating Procedures 40/41/42.
9.4.11.10.2 (08-06-2026)

Tax Fraud Investigative Assistant

  1. A TFIA provides technical support to investigative activities and has some administrative responsibilities that support the field office. For more information pertaining to TFIA assistance refer to Exhibit 9.4.11-1, Standard Operating Procedures 40/41/42.
9.4.11.10.3 (08-06-2026)

Supervisory Investigative Analyst

  1. The SIA manages the activities, assignments, training, and performance management of the IAs and TFIAs in their assigned groups. For additional information pertaining to SIA responsibilities refer to Exhibit 9.4.11-1, Standard Operating Procedures 40/41/42.
9.4.11.11 (05-24-2024)

When to Request Investigative Professional Staff Services

  1. SAs shall request IPS whenever necessary to further investigative activities.
9.4.11.12 (08-06-2026)

How to Request Investigative Professional Staff Services

  1. Requests for investigative support shall be submitted through the established Customer Support request system. For additional guidance refer to the Investigative Workspace Guide.
9.4.11.13 (08-06-2026)

Standard Operating Procedures Groups 40/41/42

  1. Criminal Investigation employees can find additional information and guidance in Exhibit 9.4.11-1, Standard Operating Procedures 40/41/42.
9.4.11.14 (05-24-2024)

Compliance Support Assistant

  1. Compliance Support Assistants (CSA) are part of the field office structure and may be centrally managed by the SAC or Assistant Special Agent In Charge (ASAC) or may be assigned to a specific work group in the field office. Each CSA provides support to more than one group.

  2. A CSA provides a variety of services. Possible services performed by a CSA include but are not limited to the following:

    1. Performs research in support of ongoing investigations and gathers, extracts, and compiles information from a variety of sources. These sources include internal and external databases and the internet.
    2. Assists as directed in various administrative and investigative tasks.
    3. Selects and uses computer applications for presentation of information to meet users’ needs.
    4. Assembles investigative files and reports into proper formats ensuring all required or related materials have been included.
    5. Inputs Criminal Investigation Management Information (CIMIS) updates as directed, assists in the maintenance of Criminal Investigation Equipment Control System (CIECS); may requisition tax returns using IDRS; may maintain the tax return inventory; and oversee the maintenance of office files.

     

9.4.11.14.1 (05-24-2024)

Field Office Resource

  1. The CSAs may be centrally managed by the SAC or an ASAC or may be assigned to a specific work group in a field office. Each CSA provides support to more than one group.
  2. The CSA duties and support are normally limited to the office environment. A CSA is not authorized to perform field investigation work typically performed by TFIAs or IAs.
9.4.11.14.2 (05-24-2024)

When to Request Compliance Support Assistance Services

  1. SAs should request the assistance of a CSA during an investigation or when help is needed. SAs should consider requesting the services of a CSA whenever services will result in more efficient use of CI’s resources.
9.4.11.14.3 (05-24-2024)

How to Request Compliance Support Assistance Services

  1. To request the services of a CSA, SAs should coordinate through the CSA’s immediate supervisor.