I'm in the UK, so this is more a question about procedure here but others can feel free to share as they wish.
While I see many of the discussions on here have been about child abuse images investigations, as things have progressed computer and mobile forensics have come to encompass all types of investigations from fraud and robbery, to rape and murder.
I begin by saying this because it may be practical in a child abuse images investigation for an officer simply to submit all seized equipment with instructions to search for IIOC and then the forensic technician with the relevant experience can simply sift through every recovered image and marking any that fit the criteria.
But what about much more complex investigations? For example a complex fraud.
It's not practical for every forensic examiner to also be a specialist in every crime types, therefore they may not have the relevant experience and intimate knowledge of the case as the officers investigating the case.
In these such cases, what's the procedure? Can it be that the forensic examiner is simply given the instructions to recover anything and everything possible and collate it all into an easily searchable format so that an officer who is working closely on the case can sift through it all in detail and ensure nothing that is of relevance is missed?
Or will the forensics guys always do the searching and always be given instructions like keywords to search for, and a general background to the case for what to look out for?
How does it work in your experience in your workplace?
Seriously no comments? I thought people would love to share on this.
As a general rule, where a case is very complex and requires extensive knowledge of the case, such as a complex fraud, I would design a strategy with the investigating officer.
If they are looking for fraudulent documents/invoices etc, it may be suitable to carve for documents and produce all these along with live documents for review by a forensic accountant.
It is very unlikely that your examiners will be experts in accounting and tax law etc are notoriously complicated.
It may be that they want documents containing keywords, in which case these can be produced for them to review.
I would honestly say that there are no set rules for these, but anything that involves a larger case should always involve review and input from the investigating officer.