3 Findings from Survey of Digital Forensic Investigators

In the fifteen years since smartphones became truly popular, law enforcement agencies have faced a growing wave of digital evidence. They are still concerned with cybercrime, white collar crime, and digital fraud, but today smartphones and other digital devices often contain evidence relating to almost every routine criminal case. The contributions digital forensic investigators and analysts make to the criminal justice process have gone from occasional participation in high-profile cases to a routine element of almost every investigation.

Unfortunately, this rapid increase in demand for digital forensic investigations hasn’t made the radically simpler. It still takes time and skilled analysis to reach accurate conclusions that will stand up in a court of law.

To better understand the challenges digital forensic units (DFUs) face, Exterro partnered with Cyber Social Hub to conduct a survey of digital forensic investigators working in law enforcement today. We asked them questions about their departments’ demographics, workflows, caseloads, use of technology, and collaboration in order to better understand the challenges they face—and how technology might be able to help them.

We received 108 responses from professionals who conduct digital forensic investigations for law enforcement agencies around the United States. On average, respondents’ DFUs consisted of 7.5 investigators; the median number was 3.5. Notably, 25% of respondents worked on large teams of 10 or more investigators, while half operated on teams of three or fewer.  Below are three key takeaways we discovered.

Despite large caseloads, digital forensic investigators aren’t consistently using automation or cloud software to accelerate investigation timelines.

The average DFU had a caseload of 130 devices per month; investigators were responsible, on average, for 17 devices. However, just 51% of investigators used automation to accelerate workflows. Evidence processing (33%) and device imaging (25%) were most common. Cloud software, with its ability to scale and foster collaboration, is another potential tool to accelerate workflows, but only 44% of respondents currently use any cloud solutions, with evidence storage and reporting tied for most common at 19%.

Even if they work a case alone, digital forensic investigators do collaborate with other professionals.

Seven in ten respondents said they never or rarely (less than 25% of the time) worked with other forensic investigators on the same case. However, almost all of them (97%) did say that other stakeholders (primarily prosecutors and non-digital forensic investigators) did review the evidence in cases. However, the problems with portable cases persist. Almost half (47% never come back to the lab). Over a quarter require reviewers to come to the lab to review data (27%). Cloud solutions offer a solution, but are not popular yet, at only 6% using them.

The biggest challenges digital forensic investigators face are the volume of data and cost of technical infrastructure.

The biggest challenges law enforcement digital forensic investigators face will be familiar to most with experience in that industry: the volume of data and the cost of technical infrastructure. In a list of five key challenges law enforcement investigators face, 70% put volume of data as one of the top two challenges, while 67% ranked technology costs in the top two. The proliferation of digital devices and increasing types and volumes pose a persistent, technical challenge to investigators, while limited government budgets force DFUs to make do with the software and hardware they have, rather than upgrading to tools that might help them cut into backlogs.

To access the complete findings of the survey, download it today.