Today’s investigators and prosecutors are very familiar with the extreme difficulty in child exploitation cases: getting through your forensic backlog to get to the data in time. Law enforcement officers routinely report that a lack of technology which, combined with stringent time limits, can severely restrict their ability to check devices in a timely manner. ADF understands that digital forensic examinations can be both costly and time-consuming, which hampers investigations into suspects that have downloaded or participated in Child Sexual Abuse Material (CSAM).
According to Wendy Williams, the Inspector of the Constabulary in the UK, “The demands faced by police are increasing constantly”, leading to what she called a reactive approach rather than a desired proactive approach to reduce risk to children. In an article with The Guardian in February of 2020 she reported that “...greater consistency and pace is needed to ensure that children are given the opportunities they deserve to thrive.”
We understand that when there are lengthy investigative delays, children are put at risk. This is a serious issue that can be addressed with the right forensic triage technology. In the UK and worldwide, this delay can be worsened by a lack of technology available to others - often from a limited budget - to perform digital forensic triage. With ADF software, law enforcement officers and prosecutors can make quick, well-informed decisions to speed investigations, all while being cost-conscious.
We’ve compiled 7 tips and best practices to help you reduce your forensic backlog with ADF digital forensic triage software:
- Use ADF’s Live and Boot Scans On-Scene as your first line of defense.
- Use a Multi-Scan approach.
- This approach allows investigators to implement a quick scan for low hanging fruit, and then increase the parameters to determine the level of relevance, and sort evidence based on your specific need. This will give you evidence and information to continue your investigation.
- Red light, green light!
- When using a single-scan approach, if a specific keyword or hash is located, it is a yes, has potential evidence, and can be seized or examined; No keyword or hash hits means it does not have potential evidence and can be placed in the queue to be examined at a later time or perhaps eliminated.
- Boot scans - useful when employed directly on evidence that may be difficult to remove from the Hard Disk Drive (HDD).
- When conducting a boot scan, if relevant data is located during a scan, ADF software has the ability to image the device from the same interface.
- Triage multiple devices with just one license!
- When employing ADF tools from a Collection Key, multiple devices can be scanned with one license, simultaneously which frees up your law enforcement budget.
- Scan multiple items at once to move through evidence quickly by removing the HDD.
- ADF software is fully customizable, giving investigators the ability to conduct very quick (minutes at most!) scans for low-hanging fruit, to more thorough scans that are comprehensive (approximately 90 minutes). Best of all, scans can be conducted by anyone with a computer, a write blocker, USB devices for collection keys, and even basic computer or forensic investigation knowledge.
- Deploy licenses to more field investigators.
- Use Field Investigator for Teams to deploy the best digital forensic software to your team and let your highly trained specialists maintain control.
When you utilize these strategies and leverage the speed and power of ADF Software solutions, you can easily reduce your digital forensic backlog.
