How Police Officers Are Tackling The Data Backlog With Digital Forensics

Police forces across the globe are struggling with unprecedented volumes of data. In the UK, 90 percent of crimes now feature some digital element and officers across England and Wales claim cybercrime data is doubling every 18 months. Yet the way in which this data is collected, processed and reviewed is time consuming and resource intensive, with an overdependency on hardware and bottlenecks caused by the need to physically get the data to Digital Forensics Units (DFUs). 

Those forces that do have the capability to process data digitally are now finding themselves hampered by the speed with which this can occur. Some cases produce such massive amounts of data that they overwhelm existing equipment.

For instance, one European federal police agency needed to process seven terabytes of data from a Mac image, including a back-up folder and several PST email files – a process that would have taken days, if not weeks, particularly with respect to then indexing the data. Being able to divide and conquer this data has therefore become paramount.

Increasingly, police forces are seeking to empower their officers on the ground through remote collection. Digital kiosks, for instance, allow them to quickly extract and process evidence. However, any subsequent data that then comes to light has to be submitted directly to the DFU which may mean evidence is not analysed side by side, leading to connections being missed, pointing to the need for a collaborative environment.

But, putting police officers in the role of the investigator requires significant adjustments to be made to ensure that the process if defensible, the chain of custody is maintained, and that the officer is also protected. Controls would therefore need to be built-in to ensure certain aspects were automated, that officers weren’t subjected to graphic material unnecessarily, and that connections were made between seemingly unrelated pieces of evidence.

Cloud-based Digital Forensics

There’s long been an awareness that the digital forensics process needed modernising. The Digital Forensic Science Strategy makes the case for a cloud-based solution to centralise data management, enable collaboration between officers and digital forensics investigators, automate and streamline processes and rationalise data storage. This would make it possible for digital evidence to be collected remotely from anywhere but was seen as unachievable until 2025 at the earliest.

Despite the challenges involved, however, West Midlands Police became one of the first forces worldwide to deploy a cloud-based digital forensics service earlier this year.

Using Exterro’s FTK Central platform housed in Microsoft Azure, the force is now collecting, processing and reviewing extremely large volumes of data at speed, whilst also centralising access allowing officers and digital forensic investigators to work on evidential data simultaneously.

Forensic and legal review workflows delivered via a single collaborative, web-based tool gives users a real-time view into their assigned cases. As the solution requires minimal training, front line officers can work with forensic reviewers, examiners, and investigators to collect, process, and review key case-evidence. 

Protecting The Police

Built-in controls help protect the user, such as Explicit Image Detection which incorporates a mental health shield for investigators by guarding against unnecessary exposure to graphic material during forensic review. The AI-powered Video Recognition and Explicit Image Detection also interfaces with CAID and Project Vic, a comprehensive unified missing/exploited children database to identify victims while cross-case analytics also helps to identify possible connections, helping to safeguard children sooner. 

Other forces stand to gain the same benefits with officers and investigators able to work flexibly and collaboratively, freeing up resource and eliminating the delays that have allowed case load data to accumulate. Forces will also be much better placed to deal with future change, with the ability to access data over a variety of endpoints and help maintain accreditation with the ISO17025 quality standard for their forensic science activities which is now a mandatory requirement. 

On the continent, the European federal police agency referred to earlier, has also been able to use the same technology to tackle its data mountain. It processed the seven terabytes of data in just an hour and 40 minutes and indexed that data in under 12 hours by configuring one Distributed Processing Manager to manage 11 Distributed Processing Engines. This effectively shared the processing power over these multiple pieces of hardware, accelerating processing speed to unparalleled levels.

Going forward, this processing capability coupled with workflow processes that both protect and empower the police, promises to significantly reduce the data backlog, expedite case reviews and increase speed to justice, helping to safeguard citizens faster. And, as AI develops, the expectation is that this form of digital forensics will lead to virtual assistants that will make causal links, propose possible avenues for further investigation, and offer up actions for consideration.

Such advances are therefore not only empowering the police and making the process faster but will also make it more thorough by exhausting every line of enquiry.

Harsh Behl is Director of Product Management (Digital Forensics and Incident Response) at Exterro

You Might Also Read: 

Europol Is Told To Delete Its 'Big Data Ark':

 

« Ukraine Predicts A Massive Cyber Attack From Russia
October Is Cyber Security Awareness Month »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Bishop Fox

Bishop Fox

Bishop Fox provides tailored security consulting services to companies across all industries. Our customers include many of the top organizations in the world.

Security Weekly

Security Weekly

Security Weekly provides free content within the subject areas of IT security news, vulnerabilities, hacking, and research.

Institute for National Security and Counterterrorism (INSCT)

Institute for National Security and Counterterrorism (INSCT)

INSCT is a center for the study of national security, international security, and counterterrorism. Research programs include New Frontiers in Science, Cyber, & Technology

ABL Cyber Academy

ABL Cyber Academy

ABL provide certified training courses in the field of cyber security and IT project management.

Dcoya

Dcoya

Dcoya's complete security awareness training program gives you out-of-the-box compliance with PCI-DSS, HIPAA, SOX and ISO regulations.

Lacework

Lacework

Lacework brings speed, scale, and automation to cloud security and allows security and DevOps teams to collaborate on keeping data and applications safe.

Versa Networks

Versa Networks

Versa is a software-defined networking vendor providing an end-to-end solution that both simplifies and secures the WAN/branch office network.

AllegisCyber Capital

AllegisCyber Capital

AllegisCyber is an investment company with a focus on seed and early stage investing in cybersecurity and its applications in emerging technology markets.

PatrOwl

PatrOwl

Automate your SecOps with PatrOwl, and start defending your assets efficiently.

DataViper

DataViper

Data viper is a threat intelligence platform designed for organizations, investigators, and law enforcement.

Envieta

Envieta

Envieta is a leader in cryptographic solutions. From server to sensor, we design and implement powerful security into new or existing infrastructure.

Vigilant Technology Solutions

Vigilant Technology Solutions

Vigilant is a global cyber security technology company offering solutions to manage entire IT & cyber security lifecycles.

Cynance

Cynance

Cynance are an award-winning, independent cyber security specialist and part of the Transputec family of companies.

Cyturus Technologies

Cyturus Technologies

Cyturus Technologies delivers cybersecurity business risk quantification services using our proprietary Adaptive Risk Model (ARM).

Cyber Bytes Foundation

Cyber Bytes Foundation

Cyber Bytes Foundation exists to establish and sustain a unique Cyber Ecosystem to accelerate the development of a strong Cyber workforce and support community outreach programs.

The PenTesting Company

The PenTesting Company

The PenTesting Company is owned and operated by offensive security professionals. Penetration Testing is essentially all we do.