Over the past six years, the nation has moved rapidly from punch cards and levers to electronic voting systems. These new systems have occasionally presented election officials with puzzling technical irregularities. The national experience has included unexpected and unexplained incidents in each phase of the election process: preparations, balloting, tabulation, and reporting results. Quick technical or managerial assessment can often identify the cause of the problem, leading to a simple and effective solution. But other times, the cause and scope of anomalies cannot be determined.

In this paper, we describe the application of a model of forensics to the types of technical incidents that arise in computer-based voting technologies. We describe the elements of e-voting that current forensic techniques can address, as well as the need for a more structured analysis, and how this can be achieved given modifications to the design of e-voting systems. We also demonstrate how some concrete forensic techniques can be utilized today by election officials and their agents, to understand voting system events and indicators. We conclude by reviewing best practices for structuring a formal forensics team, and suggest legal steps and contractual provisions to undergird the team's authority and work.