Investigation Delayed Is Justice Denied: Proposals for Expediting Forensic Examinations of Digital Evidence*

TLDR

Digital forensics laboratories face a growing backlog as routine duplicate creation and exhaustive examinations become untenable amid increasing volumes of digital evidence. The study proposes a three‑tiered forensic examination strategy to deliver timely, resource‑efficient results and to guide training and threshold updates in digital forensics laboratories. The approach delineates three examination levels, practical examples, suitable tools, and threshold criteria balancing evidence‑miss risk and offense seriousness. The authors conclude that scaling the three‑tiered strategy has significant implications for investigative efficiency.

Abstract

Abstract: There is an urgent need to reduce the growing backlog of forensic examinations in Digital Forensics Laboratories (DFLs). Currently, DFLs routinely create forensic duplicates and perform in‐depth forensic examinations of all submitted media. This approach is rapidly becoming untenable as more cases involve increasing quantities of digital evidence. A more efficient and effective three‐tiered strategy for performing forensic examinations will enable DFLs to produce useful results in a timely manner at different phases of an investigation, and will reduce unnecessary expenditure of resources on less serious matters. The three levels of forensic examination are described along with practical examples and suitable tools. Realizing that this is not simply a technical problem, we address the need to update training and establish thresholds in DFLs. Threshold considerations include the likelihood of missing exculpatory evidence and seriousness of the offense. We conclude with the implications of scaling forensic examinations to the investigation.