Better, faster, stronger: an innovative approach to digital forensics

Better, faster, stronger: an innovative approach to digital forensics
May 28, 2015 Kristofer

When it comes to law enforcement, everything has to be about crime fighting. While this may seem obvious, the explosion in digital evidence can risk deflecting attention from the end game – taking action to thwart criminals.

The volume of seized visual evidence is only set to increase so law enforcement agencies need to find new ways of approaching the investigative process. Single investigations no longer compromise of thousands of images but millions. As a result, investigators are forced to go through the slow, laborious process of manually reviewing millions of seized images, or hours of video footage, to uncover pertinent material that may be relevant to building a successful case.

The consequences of adopting this approach can be devastating. Agents unintentionally miss crucial leads, evidence is only partially reviewed, new evidence is consigned to unseen archives and the case building process becomes even slower and more labour intensive.

With the limited time and resources available, how can organisations manage, review and analyse the volume of digital evidence available in a more effective manner?

1) Prioritise new data and new victims – automated technologies, such as robust hashing, can identify images and video files that depict unidentified victims, camera serial numbers or location data so that investigators start working on hard leads first

2) Get more out of the visual data – to reveal hidden clues use image enhancement features, such as shadow boost, or look for hidden thumbnails embedded into the file header of tools like Adobe Photoshop

3) Filter out the non-pertinent files – customised filters can automatically exclude non-relevant files that don’t need manual review and place this material into a separate workflow

4) Fast video review – introduce tools that make it easier to go through reams of footage. For example, by observing active thumbnails or split video view, files can be quickly scrolled through

5) Explore camera EXIF data – camera identifiers of GPS location can be vital information to a case. Always keep an eye on EXIF indicators in the thumbnail header when reviewing new images and videos

The analysis of digital evidence is creating a paradigm shift in crime investigations. Digital forensic teams need new methods, workflows, tools and processes that are capable of reviewing and managing the growing volume of visual data available. Increasingly, technology and automation will be central to speeding up and improving the quality of digital media investigations. However, adopting a new approach will also empower law enforcement agencies to carry out more sophisticated investigations into some of society’s most serious crimes.