The chequered past and risky future of digital forensics

Abstract

There is weak integration of digital forensics and forensic science, despite over a decade of effort to break down the borders between them. As more criminal investigations involve digital traces in increasing amounts and complexity, the quality of digital forensic results is decreasing and comprehension of cybercrime is diminishing. The consequences of errors and omissions in digital forensics include imprisoning innocent people, leaving dangerous criminals free to perpetrate additional crimes, and continuing victimization of the organizations and people targeted by offences. To mitigate these risks it is necessary to harmonize digital forensics and forensic science, and to strengthen knowledge management throughout decentralized forensic ecosystems. To drive the needed harmonization and knowledge management, there are two essential roles: the investigative advisor with operational experience, and the forensic advisor with scientific background. These advisors can negotiate the borders between police, digital forensic specialists, criminal intelligence analysts and attorneys to cultivate a criminal justice system that treats digital traces effectively, has visibility across criminal activities, and addresses crime and security more strategically.