Digital Evidence Backlog: Forensic Triage and Early Case Assessment

The amount of digital information available today is overwhelming. This becomes even more obvious in the area of criminal investigations. The digital evidence that is brought in for law enforcement to examine in regards to a case is often too much and investigators don't know where to start. There are more investigators available than there are forensic examiners and this can create a backlog of digital evidence that cannot be processed as quickly as needed for each case. The case of digital evidence backlog is becoming a critical issue within law enforcement given that some agencies report that their backlog of analyzing digital evidence is up to a year or more. The amount of time taken in analyzing digital evidence can in some instances cause cases to be thrown out of the court system by violating the premise of having an expedient trial. That means that criminals go free or that innocent people go to jail, simply because there wasn't enough manpower to analyze the digital evidence fast enough.

The other issue with digital evidence is that technology is constantly changing and it is available in so many forms. Often while collecting evidence law enforcement takes everything that is digital without fully considering whether the information may be pertinent to the case or not. This creates another piece of the backlog because investigators don't know where to start or what evidence should take priority. The ability to prioritize this evidence is crucial. Using Early Case Assessment and forensic triage methods has been helpful in managing and prioritizing digital evidence. With the appropriate software and tools in place, law enforcement agencies have the ability to hand off some tasks that require less digital expertise to officers with less technical training, giving the forensic investigators the additional help they need to manage the backlog.

Early Case Assessment in conjunction with forensic triage and the appropriate software tools can help law enforcement reduce and potentially eliminate their digital evidence backlogs. Early Case Assessment helps investigators determine whether the data they are analyzing has the potential to be needed as evidence. Law enforcement and legal teams work together to assess whether the digital media is likely to contain useful information, narrow down the necessary information with specified datasets, and then retrieve the immediate need evidentiary data. Being able to identify relevant data, sort it, prioritize it, and break it down into manageable pieces helps legal teams and law enforcement make a quicker assessment of whether pursuing further investigation or litigation makes sense and take action in a timely manner. Using forensic triage methods helps define the boundaries of Early Case Assessment from the start by identifying the types of data and devices that are most likely to contain pertinent information. Doing this allows the investigators to start with what should be the most fruitful evidence pieces and work their way through to the less important pieces if necessary.

ADF Solutions is a digital forensic software company that provides software and tools that can assist in digital triage and Early Case Assessment like, Digital Evidence Investigator and Triage Investigator. Since 2005 ADF has designed and developed rapid, intelligent software used by law enforcement, military, and corporations to quickly solve digital investigations. ADF's software is easily deployable around the world on memory sticks (thumb drives) and competitive in the marketplace, providing some of the fastest investigation software. Check out ADF's software today with a 30-day free trial.