New Digital Forensic Tools: Using Improved Timelines to Solve Cases

In 2023, law enforcement officials must review more data, more often, than ever before. Where a decade ago, an investigation might have required the analysis of a single computer or a smartphone, crimes today may have a web of evidence that spans multiple devices, social media platforms, cloud data storage, and more. Multiply that by the fact that almost every crime has a digital footprint—a text message or email, photographic or video evidence, location data, an internet search—and you have a recipe for a crisis.

Law enforcement departments across the country and the globe are overwhelmed by a growing backlog of digital evidence—and it’s compounded by the lack of trained digital forensic investigators. That translates into trials that are delayed, criminals free to re-offend, and victims who can’t move on from traumatic experiences.

Even though this challenge is rooted in the spread of technology, technology also offers the solution. There’s a revolution happening in the world of digital forensics, making it possible for law enforcement departments to scale up their investigations, train new forensic analysts, review evidence more intuitively, and solve cases faster. One of the most important technology features emerging to help investigators close cases is new, logical timelines.

Timeline Views in Digital Forensics

Modern investigations deal with more data types than ever: images, video, social media posts, text messages, emails, internet histories, and more. When forced to deal with digital artifacts by type, investigators can struggle to create a holistic narrative for the case. They have to create a timeline spanning internet usage, phone calls, text messages, video and still photos, social media applications, and countless other types of data in their head. 

See how the SuperTimeline in FTK 8.0 can help you break cases open quickly!

Rather than forcing investigators to do that work, what if the digital forensic software could consolidate all these types of artifacts into a single view organized chronologically? Rather than having to assemble a storyline for the case, it would be presented right away, providing the investigator with a major head start in identifying the big picture. 

Choose where to dig deeper.

While the timeline pieces together multiple types of media, communications, and other artifacts in a single, consolidated timeline,  intuitive “hover and click” displays of relevant metadata allow the investigator to choose what to examine in more detail and with more context. 

Create a coherent case story.

By viewing artifacts representing different types of actions a subject has taken on the device in a single flow, investigators can quickly understand how disparate actions fit together into a unified narrative around the central question being investigated.

Spot anomalies easier.

Investigators can compare timelines for different days (or different devices) to reveal how they differ from each other, uncover anomalies, and provide context for your investigation. Find out what made the day in question different than all the other days before it.

As Exterro Digital Forensic Evangelist and former Forensic Analyst for the Ohio Bureau of Criminal Investigation Justin Tolman says:

Nothing on a computer or a phone exists alone by itself. There's always going to be something that leads to it, whether it's a linked file, another chat, an image, or camera data, that leads to what you're looking at. Timeline representations of digital evidence can help you understand that context much easier with much less work. 

Download our new educational resource, The Future of Digital Forensics, to learn about more new features to help you solve cases faster coming soon to Exterro FTK!