Has anyone come across any law enforcement agencies that are happy to have an initial "lightweight" report within their prosecution report (to save costs and time) on the basis that they can order a full, detailed investigation if the defendant pleads not guilty? (and no further work is required if a guilty plea is put in)
I have my own fellings on this policy (pretty much all negative) but interesting to hear other opinions,
cheers
Pat
Pat are you referring to any type of investigation (audio, video, mobile telephone, cell site analysis etc etc) or just computer investigations?
Sorry, should have said that I was referring to a forensic investigation of a basic IBM compatible PC (but the legal and practical issues for all devices are worth discussing, are they not?)
I guess it depends on what you mean by 'lightweight' and the type of investigation that you are examining a computer for.
If you're talking about indecent image type jobs, we (and I'm only speaking for my own unit here) pretty much do as light a weight examination prior to the suspect being interviewed in depth about any material found.
This 'lightweight' examination however, includes doing all the usual processing and file carving that one should do to make sure you are seeing as much as possible, and looking at all the images found. These are then categorised and an initial report produced. This report would include detail about where the images were found, along with any explanations required. Sometimes for thousands of images in live files, the initial statement can be as small as two pages.
If the suspect is then interviewed and a guilty plea is expected as a result of that, we don't have anymore work to do. If defences are raised, or the suspect is wriggling, we tell the OIC to come back to us for a more in depth report focussing on what the defences are, or what the suspect is wriggling about.
If later when the matter is approaching court and other parties become involved, other queries may arise and those questions are then fed back to us for answers.
I wouldn't really call that lightweight, like I say it depends on what you mean.
I would say however, that I think for us in LE, working within the 'system', it is easier for us to produce an initial report and re-visit a case later on if required, than it is for a contractor to LE where probably a more thorough investigation is required so that the organisation doesn't have to come back for more later on and incur further costs
What are your negative feelings towards any policy of 'lightweight' reports?
I guess it depends on what you mean by 'lightweight' and the type of investigation that you are examining a computer for.
I'd have to agree with this. In my experience, a "lightweight" investigation, when requested, typically refers to the creation of a forensic image, identifying details about the system (installation, users), and a determination of whether there are sufficent grounds for a detailed investigation.
Of course, the latter is the trickiest since, in the absence of a detailed investigation, it depends to a great extent on luck.
In general, however, I try to convince my clients that a minimal investigation still requires a substantial commitment of time (and money). Unless, of course, the system has been thoroughly wiped before being seized.