State of Digital Forensics 2017

State of Digital Forensics 2017 

Streamlined Forensic Reporting: - Misuse

The increased use of the Streamlined Forensic Reporting (SFR) system has been instrumental in coping with the explosion of digital forensic cases but, as we at KBC have seen across other disciplines, it is often being misused, perhaps inadvertently.  Potential issues with the SFR process have been recognised by the Forensic Science Regulator in her recent Annual Report. Regularly, for example, we find an SFR1 as the only forensic ‘evidence’ being presented by the prosecution, with no further scientific work having been commissioned irrespective of there being a contradictory defence statement.  This can lead to the significance of the Streamlined Forensic Report being overstated in Court, and relies on the defence to point out its limitations.  This happens in all types of cases but particularly digital cases where the provenance of the evidence is rarely investigated.  Increasingly, therefore, the defence must commission their own forensic work to demonstrate the veracity of the defendant's version of events.  In a recent indecent images case, KBC was instructed to complete a joint report with the prosecution expert a week before the trial.  The prosecution expert fully agreed with our report, stating that the defendant's version of events had not been provided to her and was completely plausible. In light of this, the case was dropped.

Location, Location, Location: - Substandard Continuity

Picture the forensic investigation of a murder scene. A suspect blood mark is located; the location of this mark, the recovery of a sample and its processing will be meticulously recorded to provide a clear continuity record to demonstrate where that evidence originated from. Digital Forensics often fails to adhere to these fundamental steps, particularly in cases involving indecent images of children.

This failure frequently originates from the outsourcing of digital forensic work from the police. The outsource providers will use forensic tools to extract all images from a device, which are then provided to the OIC for classification and ultimately charging. Along the way, poor record-keeping imparts a lack of traceability which means that neither the OIC nor the forensic provider is able to state where on a computer those images were actually found.  Where an image was stored, however, can be critical to assessing a defendant's version of events. When KBC are subsequently instructed to perform a defence review of the prosecution findings, this lack of information can make the task much more complex and costly. If the prosecution were unable to say where a DNA profile came from it would be inadmissible, yet digital evidence is routinely admitted when no one knows where it came from - except when KBC investigators are instructed to prove it!

Digital Team Expansion 

We have recently expanded our Digital Forensics team, taking on both another mobile device expert and a Cell Site Analysis expert. This should enable us to provide a faster turnaround for our clients in these areas which continue to become more and more common in our casework. We also continue to invest in the best forensic software and the development of our own specialist tools, allowing us to recover data which others might miss (read some case studies here).