Nina van der Knaap, PhD Student (eLaw), Leiden University

Nina, you’re currently doing a PhD in eLaw and teaching at the Cyber Security Academy (Cyber Forensics & Cybercrime and Law Enforcement). Could you tell us how you became interested in this area?

I am a forensic criminologist and I noticed that digital forensics (the topic of my PhD) is not a subject at the moment in the Masters I was following. I’ve always had an interest in computers so I contacted a company (Fox-IT) in Holland that handles digital forensic investigations and asked if they would be willing to let me have an internship to learn more about the field. They said I could and I worked there one day every week for 8 months next to my other fulltime internship and learned a lot.This only sparked my interest in the field further, so together with Fox-IT and the University of Leiden I set up a PhD. I started my PhD at the beginning of 2013 and I worked for Fox-IT as well.

Your research at the moment is focused on backlogs in digital forensics investigations, a theme that has been discussed at several conferences recently. Could you give us an overview of the research and the results so far?

Backlogs seem to be a problem that has been around for quite some time but it is difficult to quantify the problem. I wanted to see if it was possible to gather data on the topic. Luckily and with help from lots of people in the digital forensics community the survey has got almost 60 respondents to date. The groups with the biggest backlogs seem to be the law enforcement and government groups. That is not really surprising because the private sector has more discretion in which cases they take on.

Furthermore, the average backlog for respondents who reported one in 2013 is 3-4 months. The longest backlog reported in 2013 is 18 months. The backlogs seem to have gotten a little better compared to the 5 previous years though. When the survey closes for good (at the end of the year) I want to differentiate between countries (if possible) and continents too.


Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

Do you think there are any significant differences between private agencies and law enforcement when it comes to backlogs? Why/why not?

Yes there is a big difference in the fact that law enforcement has little say in the cases they need to investigate. I also think the kinds of cases are different in nature and often the corporate cases are more focused on finding out what happened instead of finding a suspect and getting him (or her) convicted in court; that has an impact on the time needed to find the proper evidence.

What do you think the major developments will be in digital forensics over the next couple of years?

I hope the backlogs will soon be a thing of the past, but I fear the field will only get more complex. More systems, more computers embedded in every object (the internet of things), more cloud services will make evidence more prevalent but also more difficult to find, analyse and interpret.

I think that digital investigators will have to specialise in a certain field more than they do now. And I think that the specialists will have to be in charge of the really complex cases, while detectives (for law enforcement) will be trained to use special programs to handle the “easier” cases with more cut-and-dried evidence.

Do you have any advice for students who are just starting out in their digital forensics studies?

It is a great field, do not let it overwhelm you! And I’ve found that most people in the field are always willing to help each other out, so ask for help. Lastly, I wish academic programs would devote more attention to the field, since computers are not likely to disappear.

What do you do to relax when you’re not researching or working?

I love to read about digital forensics, forensics, cyber crime and thriller novels (James Rollins is one of my favorites). I also like to work out, running and biking mostly, and I can truly relax walking around my town with my husband.

Nina van der Knaap is a PhD student at Leiden University. Her current research looks at backlogs in the digital forensics field; her survey is running until the end of 2014 and can be found here. She also teaches at The Hague's Cyber Security Academy.

Leave a Comment

Latest Videos

In this episode of the Forensic Focus podcast, Si and Desi explore how artificial intelligence is being leveraged to uncover crucial evidence in investigations involving child sexual abuse material (CSAM) and examine the importance of exercising caution when implementing these tools. 

They also discuss a recent murder case in which cyber experts played a vital role in securing a conviction, and explore the unique challenges associated with using digital evidence as an alibi.

Show Notes:

A Practitioner Survey Exploring the Value of Forensic Tools, AI, Filtering, & Safer Presentation for Investigating Child Sexual Abuse Material (CSAM) - https://dfrws.org/wp-content/uploads/2019/06/2019_USA_paper-a_practitioner_survey_exploring_the_value_of_forensic_tools_ai_filtering_safer_presentation_for_investigating_child_sexual_abuse_material_csam.pdf

Man charged with NI murder ‘faked live stream to provide alibi’ (The Guardian) - https://www.theguardian.com/uk-news/2023/feb/02/man-charged-with-ni-faked-live-stream-to-provide-alibi

A YouTuber accused of murder faked a 6-hour livestream to produce an alibi (Sportskeeda) - https://www.sportskeeda.com/esports/news-a-youtuber-accused-murder-faked-6-hour-livestream-produce-alibi

European Interdisciplinary Cybersecurity Conference (EICC) 2023 - https://www.forensicfocus.com/event/european-interdisciplinary-cybersecurity-conference-eicc-2023/#more-493234

YouTuber reportedly faked GTA livestream to have an alibi while he committed murder (Dexerto) - https://www.dexerto.com/entertainment/youtuber-reportedly-faked-gta-livestream-to-have-an-alibi-while-he-committed-murder-2052974/

Forensic Europe Expo - https://www.forensicfocus.com/event/forensic-europe-expo/#more-493225

In this episode of the Forensic Focus podcast, Si and Desi explore how artificial intelligence is being leveraged to uncover crucial evidence in investigations involving child sexual abuse material (CSAM) and examine the importance of exercising caution when implementing these tools.

They also discuss a recent murder case in which cyber experts played a vital role in securing a conviction, and explore the unique challenges associated with using digital evidence as an alibi.

Show Notes:

A Practitioner Survey Exploring the Value of Forensic Tools, AI, Filtering, & Safer Presentation for Investigating Child Sexual Abuse Material (CSAM) - https://dfrws.org/wp-content/uploads/2019/06/2019_USA_paper-a_practitioner_survey_exploring_the_value_of_forensic_tools_ai_filtering_safer_presentation_for_investigating_child_sexual_abuse_material_csam.pdf

Man charged with NI murder ‘faked live stream to provide alibi’ (The Guardian) - https://www.theguardian.com/uk-news/2023/feb/02/man-charged-with-ni-faked-live-stream-to-provide-alibi

A YouTuber accused of murder faked a 6-hour livestream to produce an alibi (Sportskeeda) - https://www.sportskeeda.com/esports/news-a-youtuber-accused-murder-faked-6-hour-livestream-produce-alibi

European Interdisciplinary Cybersecurity Conference (EICC) 2023 - https://www.forensicfocus.com/event/european-interdisciplinary-cybersecurity-conference-eicc-2023/#more-493234

YouTuber reportedly faked GTA livestream to have an alibi while he committed murder (Dexerto) - https://www.dexerto.com/entertainment/youtuber-reportedly-faked-gta-livestream-to-have-an-alibi-while-he-committed-murder-2052974/

Forensic Europe Expo - https://www.forensicfocus.com/event/forensic-europe-expo/#more-493225

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_7QiFTiuY7Vw

AI In CSAM Investigations And The Role Of Digital Evidence In Criminal Cases

Forensic Focus 22nd March 2023 11:44 am

Throughout the past few years, the way employees communicate with each other has changed forever.<br /><br />69% of employees note that the number of business applications they use at work has increased during the pandemic.<br /><br />Desk phones, LAN lines and even VOIP have become technologies of the past workplace environment as employees turn to cloud applications on their computers and phones to collaborate with each other in today’s workplace environment.<br /><br />Whether it’s conversations in Teams, file uploads in Slack chats, or confidential documents stored in Office 365, the amount of data stored and where it is stored, is growing quicker than IT and systems administrators can keep up with.<br /><br />Corporate investigators and eDiscovery professionals need to seamlessly collect relevant data from cloud sources and accelerate the time to investigative and discovery review.<br /><br />With the latest in Cellebrite’s remote collection suite of capabilities, investigators and legal professionals can benefit from secure collection with targeted capabilities for the most used workplace applications.<br /><br />Join Monica Harris, Product Business Manager, as she showcases how investigators can:<br /><br />- Manage multiple cloud collections through a web interface<br />- Cull data prior to collection to save time and money by gaining these valuable insights of the data available<br />- Collect data from the fastest growing cloud collaboration applications like Office365, Google Workspace, Slack and Box<br />- Login to a single source for workplace app collection without logging into every app and pulling data from multiple sources for every employee<br />- Utilize a single unified collection workflow for computer, mobile and workplace cloud applications without the need to purchase multiple tools for different types of collections – a solution unique to Cellebrite’s enterprise solution capabilities

Throughout the past few years, the way employees communicate with each other has changed forever.

69% of employees note that the number of business applications they use at work has increased during the pandemic.

Desk phones, LAN lines and even VOIP have become technologies of the past workplace environment as employees turn to cloud applications on their computers and phones to collaborate with each other in today’s workplace environment.

Whether it’s conversations in Teams, file uploads in Slack chats, or confidential documents stored in Office 365, the amount of data stored and where it is stored, is growing quicker than IT and systems administrators can keep up with.

Corporate investigators and eDiscovery professionals need to seamlessly collect relevant data from cloud sources and accelerate the time to investigative and discovery review.

With the latest in Cellebrite’s remote collection suite of capabilities, investigators and legal professionals can benefit from secure collection with targeted capabilities for the most used workplace applications.

Join Monica Harris, Product Business Manager, as she showcases how investigators can:

- Manage multiple cloud collections through a web interface
- Cull data prior to collection to save time and money by gaining these valuable insights of the data available
- Collect data from the fastest growing cloud collaboration applications like Office365, Google Workspace, Slack and Box
- Login to a single source for workplace app collection without logging into every app and pulling data from multiple sources for every employee
- Utilize a single unified collection workflow for computer, mobile and workplace cloud applications without the need to purchase multiple tools for different types of collections – a solution unique to Cellebrite’s enterprise solution capabilities

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_g6nTjfEMnsA

Tips And Tricks Data Collection For Cloud Workplace Applications

Forensic Focus 20th March 2023 11:00 am

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feed settings page to add an API key after following these instructions.

Latest Articles

Share to...