Yes they spend their last dime to proof innocence. Normal cases run like People hope for the Police, they dont know of good DF professionals on the market. As the case evolves frustration about what the Police is doing grows, may a lawyer recommends to pay for a DF Professional.
But digital evidence on-site is a matter of immediately. My experience is if victims overcome the shock of abuse do not take immediately into account to 'freeze the digital layer'. After bringing a case to the Police they hand it over to the prosecution department (Staatsanwaltschaft). They - I agree are lawyers and incompetent.
Suspects do everything to 'hide the crime' - they are more active than victims in a shocked-state.
If suspects hear that a criminal complaint was started (they get informed from the prosec dept.), they realize 'oh s**t'. Hiding starts.
Reality is manytimes better in respect that suspects are also digitally incompetent and do not know the skills of digital examiners. This helps to find evidence.
Organized crime - I deal with these guys - are perfect in deception and digitally camouflage. But humans make mistakes - Police too - and this is the only chance.
BTW we recently had a case of mafia where they transfered tiny paper-messages in Panini FIFA 365 envelopes handing them over to the bosses's children by visiting them. We found the Point-of-Kill as we physically saw the clear-cutted envelopes. Children don't do this -)
Back to How you know a DF Professional is capable of cracking the criminal element as he is master in the technical domain?
Back to How you know a DF Professional is capable of cracking the criminal element as he is master in the technical domain?
You don't. You have a team of varying expertise that are good on different aspects of an investigation with the occasional overlap. You just don't take someone who is familiar with police procedures and putting them in front of XWays and expect magic, the same goes for taking a memory forensics guy and putting them in charge of witness interrogation. The world doesn't work that way.
I remember seeing a horrible job ad a while back with an insane amount of skill requirements for a position at EUROPOL, apart from DFIR it had police requirements, physical fitness requirements, pentest requirements (seriously wtf?) as well as some things no one would even bother with in other positions. I thought "good luck with that" as i closed down the tab in my browser.
You are right. Europol is searching for superheros who do not exist. As long the only focus is on certificates and no real assessment is made to recognize the 'creative brain potential' to solve the impossible good or very good candidates drop-out in the HR process.
Its proven that geniuses are not detected by non-geniuses. But the only genius I know personally is the most humble person. He always says he is 'behind schedule'. Right, we all are.