Investigation Delayed Is Justice Denied: Proposals for Expediting Forensic Examinations of Digital Evidence*
- 23 October 2009
- journal article
- other
- Published by Wiley in Journal of Forensic Sciences
- Vol. 54 (6), 1353-1364
- https://doi.org/10.1111/j.1556-4029.2009.01150.x
Abstract
There is an urgent need to reduce the growing backlog of forensic examinations in Digital Forensics Laboratories (DFLs). Currently, DFLs routinely create forensic duplicates and perform in-depth forensic examinations of all submitted media. This approach is rapidly becoming untenable as more cases involve increasing quantities of digital evidence. A more efficient and effective three-tiered strategy for performing forensic examinations will enable DFLs to produce useful results in a timely manner at different phases of an investigation, and will reduce unnecessary expenditure of resources on less serious matters. The three levels of forensic examination are described along with practical examples and suitable tools. Realizing that this is not simply a technical problem, we address the need to update training and establish thresholds in DFLs. Threshold considerations include the likelihood of missing exculpatory evidence and seriousness of the offense. We conclude with the implications of scaling forensic examinations to the investigation.Keywords
This publication has 7 references indexed in Scilit:
- Selective and intelligent imaging using digital evidence bagsDigital Investigation, 2006
- Investigating sophisticated security breachesCommunications of the ACM, 2006
- Computer Forensics Field Triage Process ModelThe Journal of Digital Forensics, Security and Law, 2006
- A hierarchical, objectives-based framework for the digital investigations processDigital Investigation, 2005
- Risk sensitive digital evidence collectionDigital Investigation, 2005
- Tool review – remote forensic preservation and examination toolsDigital Investigation, 2004
- A review of Anglo-American forensic professional codes of ethics with considerations for code designForensic Science International, 2002