The Digital Forensic Research Working Group (DFRWG) has been set up to support collaboration between UK policing, academia and industry in digital forensic science R&D. The group will investigate ongoing relevant research to inform FCN Science, coordinate contact with researchers working in the field and support the delivery of the NPCC Digital Forensic Science Strategy.
This research groups objectives are;
- Determine and agree a statement of research needs to support the NPCC Digital Forensic Strategy
- Research landscape: a summary of ongoing relevant research nationally
- Identify opportunities for research funding and timelines for key funding/project bids
- Support the documentation and collaboration of research bids
- Provide guidance as required in support of the NPCC Digital Forensic Science Strategy
- Identify opportunities for engagement/information sharing and events.
- Report into the NPCC Research and Innovation Capability Board.
- Ensure that any research undertaken is shared with the COP What Works Research Map.
Carolyn has significant experience working within operational police forensic units. Predominantly within crime scene investigation. Carolyn has had a varied career since joining the police in 1995, from fingerprint enhancement, DVI, crime scene management and coordination, and previous to joining the FCN had been part of the senior leadership team within a local police forensic service. Carolyn has a master’s in forensic Archaeology and has recently completed her Doctorate focused on the investigation of sexual offences. Carolyn is an honorary lecturer at the University of Portsmouth and supports and supervise student research. Carolyn is the strand lead for Research and Innovation for the NPCC Digital Forensics Portfolio.
Suggested key areas of research to support Digital Forensic Investigations
- Managing and Exploiting Data
- Information, disinformation, and communication
- Behavioural adaption
- Data ethics
- Interpretation of digital evidence
- Organising and coordinating digital forensic provision
- Recruitment, retention and well-being of the workforce.
Integral to this is a closer collaboration with law enforcement, vendors and academia and legal practitioners to reduce the gap between new technologies, their use in the investigation in alleged criminal activities. This includes the development of scientifically robust analytical tools to enable investigators to access and examine data from digital devices which will address the legitimate expectations of the Courts and the public. To do this we need to work together to seek solutions to generate the data and research required to scientifically underpin the approaches used for legal acceptance within the CJS and be able to know how to scientifically examine a technology before it reaches the market.
Managing and Exploiting Data - is a current key challenge for the CJS specifically associated with the amount and the complexity of the data. The usefulness, relevance, and contribution of the data for investigations and the CJS needs to be fully explored. Research needs to explore ways to combat this challenge using current and emerging technologies including Artificial Intelligence and Machine Learning. Critical to this is ensuring access to a wide variety of datasets of known provenance -Ground Truth Data Sets). This is important to ensure quality outputs and determine how to test, robustly validate and verify systems for the CJS. In particular, there is a need to provide robustly scientifically validated machine learning systems and methods for the retrieval, triage, and search of digital data from multiple devices as well as systems which ensure that the storage, access and security of digital evidence is maintained in a fair, ethical and lawful way.
Information, disinformation, and communication - citizens demand and expect more from those investigating and detecting crime. The notion of trust and legitimacy of the science and the ethical use of data within the CJS is significant. The introduction of evidence via non – traditional ways such as screen shots (message templates/generators) and other digital formats are increasing. There is a further need to understand the cross overs and gaps between the treatment of images/audio/video evidence processes compared with those of DF hardware evidence (phones/laptops etc).
- How are these materials processed when they are added to chain of evidence?
- How can we vouch for the quality and evaluation of the analysis and results before it is included in chain of evidence?
- The disclosure of the evaluative outcomes of the interpretation of digital evidence needs to be undertaken via validated quality assured methodology ensuring transparency and equality of arms for the defence.
Caution is necessary to avoid the incorrect evaluation of digital evidence. Research needs to focus on the current and emerging risks of evidence being manipulated/amended (for example through deep fakes etc), before being disclosed to assure the legitimacy and trust in both process and procedure when related to digital evidence.
With increasing demand for digital forensic applications, automation of key functions is deemed essential to increase throughput and reduce times for digital forensic examinations. Research needs to focus on the development of scientifically robust automated methods which deliver maximum benefit and efficiency, but more importantly, are trusted by both the public and legal practitioners. Furthermore, we need to risk manage the implementation of any new processes should a failure occur. New processes require will require investment in training and new expertise within policing and other stakeholder communities.
Increase in the use of automated processes and more powerful analytical tools mean that it is increasingly important to consider when humans are integral to decision making. There is minimal research addressing this currently. There are many existing workflows which make use of an analytical tool followed by a human expert evaluating and making decisions (e.g. fingerprint comparison or automatic facial recognition). In theory the machine might become better at the job than the human (as has been seen in the interpretation of medical images), but at what point would this be and are the appropriate legal frameworks in place? Broader research is required in this area across many policing/forensic science and expert roles as digital processes are formerly adopted.
The ethical issues associated with data and its use within the policing context remains under scrutiny. The requirements for trust, legitimacy, privacy, and proportionate intrusiveness is crucial for the development of Digital Forensic Investigative strategies. A research focus is required for current and emerging technologies to understand their application within the criminal justice context along with a broader citizen science approach to gauge public views and use of digital technologies.
Interpretation of Digital Evidence
Findings from analysis of digital devices, data and communications have often been considered as factual, with little exploration of the uncertainties and inferences involved in their interpretation. A research focus is required to develop understanding and to generate the ground truth (known provenance) data sets needed to enable contextual evaluation of evidence in relation to the source of digital traces and the activities by which they arose. This is a critical area for the presentation of digital evidence in court and for the courts to have confidence in the evidence presented.
Organising and coordinating digital forensic provision
Historically, digital forensics has been delivered in a context marked by budgetary restrictions, financial uncertainty and short-term planning. Forces at different stages of preparedness, with variable resources and expertise have been dealing with an increase in demand for analysis. More is needed in terms of understanding the organisational challenges encountered in the delivery of digital forensic support. How does organisational change impact on this delivery? What is good practice in digital forensics? What is successful change and how is it implemented? How can we identify and disseminate ‘what-works’ in several key areas such as triage, accreditation, risk assessment, training, support and retention of workforce?
Recruitment, retention and well-being of the workforce.
The recruitment, retention and well-being of practitioners are crucial to the provision of forensic support services to forces. Several factors have been attributed to the challenges in the recruitment and retention of digital forensic practitioners and related personnel. For instance, the viewing of indecent images of children is often categorised as primary traumatisation and a traumatic stress factor. What services are available to address this issue and how effective are they? Moreover, digital forensic activities are not confined solely to digital forensic units or provided only by digital forensic practitioners and specialists. Other users undertake such activities (e.g., Digital Media Investigators, Cyber Advisors, academic and legal experts) that have implications for providing an effective service, maintaining the quality of digital forensic standards and ensuring the reliability legally admissible outputs. More is needed in terms of understanding how personnel are trained and retained nationally, what are the challenges in this area and how they can be addressed.
We want to hear from you
New ideas, tricky questions, difficult challenges. Get in touch with your forensic network.