Why You Need a Digital Forensics Investigator

Kendall Platt, Forensic Access, discusses the digital forensic investigator's role in a criminal justice system and how the service can fall short of what is required by legal professionals.

The demand for digital forensics investigation is increasing. At Forensic Access we have seen enquiries for digital forensics expert witness reports double in the last 3 months.

But what does a digital forensic investigator do?

A digital investigator downloads data from various digital devices in the form of digital forensic images. They can access information from physical devices such as mobile phones to sat navs, tablets to drones, though they are also able to access information in the cloud (with your client’s permission). Once they have this data they then ‘interrogate’ it. This includes checking the validity and authenticity of the information, analysing for patterns and anomalies whilst examining metadata. Then, crucially, a digital forensic investigator will interpret all findings within the context of your case. This answers the ‘How’ and the ‘why’ that are often crucial to your client’s case.

There are situations where a client’s phone has been seized by the police as they believe there is something on it that may assist the prosecution, though the phone has not been investigated. The data may well have been downloaded earlier in the enquiry by a technician, however this data often goes un-investigated until the trial is imminent due to high demand within police digital forensic units.

This time pressure means that a large majority of cases are investigated with a ‘find evidence, then stop’ attitude. The method of reporting is such that there is very little detail that explains how the evidence may have come to be on your client’s device. There is rarely an explanation as to what actions may or may not have been taken by your client for the evidence to get there.

In fact, Dr Gillian Tully (the Forensic regulator) in her latest report highlights this issue well by saying:

‘Throwing massive volumes of extracted data to investigators, who generally lack the tools and methods to interrogate the data effectively, just shifts a problem; a more integrated approach could be transformative.’

It is this integrated approach that we’re passionate about at Forensic Access.

We work in a collaborative manner with you and the client. Our digital forensics experts will ask you for an overview of the case and to provide the digital evidence put forward by the crown.

Often, they will need to contact the police digital forensics investigator to obtain a forensic image (effectively a copy) of the device at the time that it was seized. It is crucial that they have this in order that they can ensure they are looking at exactly what the crown have examined. Once they have this image and your client’s version of events, they can interrogate the data to answer your questions.

Dr Tully’s comment also alludes to one of the biggest challenges that all digital forensic investigators face. Software is ever evolving. Many of the social media apps are becoming encrypted to protect the user’s data. This presents a problem to the investigator trying to access the contents that may contain information pertinent to the investigation. The investigator must adapt the methods and techniques they use in order to download the data and interrogate it in a meaningful way.

This necessary constant adaptation of methods is impacting on the timeline for all digital investigators to achieve accreditation, something that was due to be completed by 2017.

Given this a Digital Forensic Working Group has been put together by the Forensic Science sub-group of the Criminal Justice Board which hopes to unify the approach of the many investigators out there in order that the methods used across the board are effective and support the Criminal Justice System (CJS) in the best way possible.

To find out more about forensic services offered by Forensic Access fill-in our online contact form (add link under text) or Tel: 01235 774870 to speak with our team.