Triage: A practical solution or admission of failure

doi:10.1016/j.diin.2013.01.002

Digital Investigation

Volume 10, Issue 2, September 2013, Pages 87-88

https://doi.org/10.1016/j.diin.2013.01.002 Get rights and content

Abstract

An experienced investigator, digital forensic examiner, and academic reflects on the strengths and weaknesses of the use of triage. The author argues that the current practice, while a practical necessity, is a failure of the forensic process and software. It is suggested that triage be re-imagined as a formal process that can be measured for efficiency and efficacy.

References (2)

D. Farmer et al.
Forensic discovery
(2005)
M. Pollitt
Digital orange juice
J Digit Forensic Pract
(2008)

Cited by (22)

Digital evidence strategies for digital forensic science examinations
2023, Science and Justice
Given the size and complexity of many digital forensic science device examinations, there is a need for practitioners to formally and strategically determine a course of conduct which allows them to undertake the most robust and efficient examination possible. This work outlines both the need for practitioners to have a digital evidence strategy (DES) when tackling any given examination scenario, how to construct one and the concerns which exist when no formal DES is in place. Approaches to DES development are examined and the context to which they should be deployed are analysed, with focus being on the use of DESs at the examination/processing stage of the investigative workflow. Finally, a ‘DES skeleton’ is offered to guide practitioners as they seek to create their own DES.
Why teach crime scene management to forensic university students?
2022, Science and Justice
Despite enhanced forensic collaborations between law enforcement agencies and universities, crime scene management remains a domain seen more as technical than scientific, largely carried out by sworn police officers qualified as scene of crime officers (SOCOs), confining forensic graduates to specialized expertise fields. Under such circumstances, we must ask ourselves why and how do we provide a generalised dedicated course to academic pupils who are not primarily intended to join such teams, excepting sometimes to assist them on a specialized field (explosion, arson, etc.)?
Currently in Quebec, forensic graduates cannot join crime scene units attached to police forces, mainly because of unions, which argue about the need to be an experienced police officer before qualifying for a crime scene course.
Based on the operational experience of the author, who created the foundational graduate forensic programme in Quebec, Canada, this paper will explain why such an academic course is still of high importance, its rationale within an academic curriculum, its goal and its implementation. Challenges are still to be considered, but selected feedback from students who understood that the aim of this course is distinct from their formal support disciplines, encourage such an approach.
Triaging digital device content at-scene:- Formalising the decision-making process
2022, Science and Justice
Citation Excerpt :
There is no doubt that the field of digital forensics (DF) can no longer apply the traditional analysis approach of ‘examining all files’ on a given device in all circumstances [1].
The prominence of technology usage in society has inevitably led to increasing numbers of digital devices being seized, where digital evidence often features in criminal investigations. Such demand has led to well documented backlogs placing pressure on digital forensic labs, where in an effort to combat this issue, the ‘at-scene triage’ of devices has been touted as a solution. Yet such triage approaches are not straightforward to implement with multiple technical and procedural issues existing, including determining when it is actually appropriate to triage the contents of a device at-scene. This work remains focused on this point due to the complexities associated with it, and to support first responders a nine-stage triage decision model is offered which is designed to promote consistent and transparent practice when determining if a device should be triaged.
“I couldn't find it your honour, it mustn't be there!” – Tool errors, tool limitations and user error in digital forensics
2018, Science and Justice
The field of digital forensics maintains significant reliance on the software it uses to acquire and investigate forms of digital evidence. Without these tools, analysis of digital devices would often not be possible. Despite such levels of reliance, techniques for validating digital forensic software are sparse and research is limited in both volume and depth. As practitioners pursue the goal of producing robust evidence, they face the onerous task of both ensuring the accuracy of their tools and, their effective use. Whilst tool errors provide one issue, establishing a tool's limitations also provides an investigatory challenge leading the potential for practitioner user-error and ultimately a grey area of accountability. This article debates the problems surrounding digital forensic tool usage, evidential reliability and validation.
Policing and Crime Act 2017: Changes to pre-charge bail and the impact on digital forensic analysis
2018, Computer Law and Security Review
Following the enactment of the Police and Crime Act 2017, subsequent amendments to the Police and Criminal Evidence Act 1984 have seen a ‘cap’ placed on the length of time a suspect can be released on bail; a process commonly referred to as ‘police bail’ or ‘pre-charge bail’. Whilst designed to instil consistency and certainty into bail processes to prevent individuals being subject to lengthy periods of regulation and uncertainty, it places additional pressures on forensic services. With a focus on digital forensics, examination of digital media is a complex and time-consuming process, with existing backlogs well documented. The need for timely completion of investigations to adhere to pre-charge bail rules places additional stress on an already stretched service. This comment submission provides an initial analysis of new pre-charge bail regulations, assessing their impact on digital forensic services.
Decision-theoretic file carving
2017, Digital Investigation
Citation Excerpt :
Digital forensic investigations must process large amounts of evidential data with limited resources (Casey et al., 2009; Pollitt, 2013).
This article explores a novel approach to file carving by viewing it as a decision problem. This allows us to design algorithms that produce best-effort results under given resource constraints. Resource-constrained carving is important for digital forensic triage, as well as for e-discovery, where a reduction in carving time may be preferred to completeness. In this work we give a formal definition of decision-theoretic file carving. As an illustration, we developed a JPEG file carving tool using the described decision-theoretic algorithm. We then examine the results of decision-theoretic file carving compared with linear carving methods to demonstrate when decision-theoretic carving is most useful.

View all citing articles on Scopus

View full text

Research summaryTriage: A practical solution or admission of failure

Abstract

Forensic discovery

Digital orange juice

J Digit Forensic Pract

Research summary
Triage: A practical solution or admission of failure