Let me offer an alternative view. Advice from "technical experts" is often given from the limited perspective of their role, the technical expert works in a bubble and does not have to consider the wider perspectives that someone responsible for managing an investigation does. In the context of the whole view, where there are limited resources that are diminishing, the investigator has to use resources as effectively as possible. This means that it is not possible to take a purely scientific view whereby every line of enquiry is followed and every digital device is examined to the maximum. Every police enquiry, no matter how serious is subject to a limitation in resources, not every item seized in a homicide is sent for forensic examination, house to house enquiries have parameters set, etc. A large proportion of digital forensic practitioners have struggled with this concept and have held the view that everything has to be examined in detail otherwise something will be missed. The bottom line is that this is not tenable and digital forensic investigations have to be managed according to the resources available, one good way to do this is to devolve digital investigations in lower level investigations to the investigating officer. This needs to be carefully managed and supervised, preferably by those technical experts, and done in the correct way this is a good way to use resources effectively.
H
Great post; it's worth adding that not only is it rarely possible for any digital analysis to be truly exhaustive, but that digital forensics is almost always only one strand of the investigation.
Let me offer an alternative view. Advice from "technical experts" is often given from the limited perspective of their role, the technical expert works in a bubble and does not have to consider the wider perspectives that someone responsible for managing an investigation does. In the context of the whole view, where there are limited resources that are diminishing, the investigator has to use resources as effectively as possible. This means that it is not possible to take a purely scientific view whereby every line of enquiry is followed and every digital device is examined to the maximum. Every police enquiry, no matter how serious is subject to a limitation in resources, not every item seized in a homicide is sent for forensic examination, house to house enquiries have parameters set, etc. A large proportion of digital forensic practitioners have struggled with this concept and have held the view that everything has to be examined in detail otherwise something will be missed. The bottom line is that this is not tenable and digital forensic investigations have to be managed according to the resources available, one good way to do this is to devolve digital investigations in lower level investigations to the investigating officer. This needs to be carefully managed and supervised, preferably by those technical experts, and done in the correct way this is a good way to use resources effectively.
HGreat post; it's worth adding that not only is it rarely possible for any digital analysis to be truly exhaustive, but that digital forensics is almost always only one strand of the investigation.
Well I wish Police officers understood the first quote a bit better! You should see the attempts made in my lab day after day by Police officers to have everything seized examined!
It's quite simple in my opinion; most Police officers have a very poor understanding of digital forensics; the exceptions to whom we all owe a great deal, are few and this devolvement will result in bad practice.
It is not a case of the "technical experts" being unaware that they are but a small part of the inquiry, it is not a case of the "technical experts" freaking out when they cant do a thesis on a memory card. It is simply that the "technical experts" advice is being ignored yet again by those who will be long gone when the s**t hits the fan.