Information has gone from scarce to superabundant. This brings huge new benefits for organisations, but also big headaches. This is a similar challenge for an investigator and whilst data is not the only key to investigation, it can provide an accurate and impartial consideration of past events. But whilst data can be more dependable than the human mind, it can present some unique challenges to the investigator. Forensic technology is the practice of dealing with data in such a way that it can be incorporated into an investigation successfully.

It is essential that data is fully incorporated when conducting an investigation. Data should be viewed as central to the investigative process, not as a separate entity. As with other aspects of an investigation, the process is significantly more effective and efficient if the different components are connected together. The key goal in any investigation is to empower through the appropriate and intelligent analysis of data.

As well as being prevalent and persistent, data can also be highly volatile and can easily be tampered with, regardless of intention. Therefore it is important that the process of managing such data in an investigative sense is dealt with: in the initial stages; in a forensically accurate matter; and in all-inclusive way.

This is particularly the case in serious or complex investigations where a failure to identify volatile digital data can have a significant impact on the conduct of the investigation. It is imperative that investigators develop appropriate strategies to identify the existence of digital evidence.

It is essential that during an investigation, irrespective of the size or complexity, five primary stages, as highlighted in The Association of Chief Police Officers (ACPO) Good Practice Guide for Digital Evidence, are followed to ensure that data is concrete and complete, otherwise organisations may find that results are not admissible in a court of law. The five key stages are as below:

  • Data Capture and search and seizure at crime scenes
  • Data Examination
  • Data Interpretation
  • Data Reporting
  • Interview of Witness and Suspects

Finally, whilst technology may never replace humans within an investigation, it will almost certainly enable them to understand, connect and analyse more data from different sources in a single environment. Therefore it is essential when advancing with an investigation that, not only is the full scope of data considered, but also that technology is used to drive efficiencies within the investigation.