Towards a Smart Digital Forensic Advisor to Support First Responders with At-Scene Triage of Digital Evidence Across Crime Types

打造智能数字取证顾问，支持急救人员对不同犯罪类型的数字证据进行现场分类

• 批准号: ES/Y010647/1
• 负责人: Mark Warner
• 金额: $ 57.45万
• 依托单位: University College London
• 依托单位国家: 英国
• 项目类别: Research Grant
• 财政年份: 2024
• 资助国家: 英国
• 起止时间: 2024 至 无数据
• 项目状态: 未结题
• 来源: https://gtr.ukri.org/projects?ref=ES%2FY010647%2F1
• 关键词: Towards; Smart; Digital; Forensic; Advisor

Over 90% of reported crime involves a digital device, and the increased use of digital devices in criminality has resulted in significant backlogs within the departments that forensically examine these devices. Despite this backlog, front-line officers often seize devices that have little evidential value to an investigation. This is perhaps unsurprising, as most digital evidence is seized by front-line officers who often lack awareness and training around digital forensics and technology. The speed at which technology develops and is adapted for use in criminality means that even those with advanced training can struggle to stay up to date. This can lead to risk-averse decision-making and a "seize all" mentality, increasing the digital forensic backlog. Prior research and government reports highlight the issues related to the digital forensic backlog within Policing and highlight how existing approaches are in need of modernisation to help address the problem. Digital device triage is one potential way of helping to reduce the backlog. This is the process of evaluating digital devices at a crime scene to assess their investigative value based on the circumstances of the case. Devices deemed likely to be of evidential value would be seized and submitted to a digital forensics lab for in-depth examination and analysis. While this approach may be effective in reducing the number of devices seized, there is a risk of inconsistent approaches to triage decision-making, and low digital awareness reducing decision-making effectiveness. This project makes a first step in addressing this, by laying the foundations for developing a smart digital forensic advisor tool to support first responders conducting digital evidence triage at-scene.To do this, we will explore existing practices, resources, challenges, and user needs around the process of search and seizure of digital devices across two distinct crime types. Through this, we will identify data that could be used to inform the smart advisor tool, and data gaps that the tool itself could address. We will also be exploring both the legal and ethical implications of its use, due to the tool's potential in helping to shape decision-making. Finally, drawing on our findings we will develop a set of early-stage low-fidelity prototypes to present back to our user groups.

超过90％的报告犯罪涉及数字设备，并且增加数字设备在犯罪行为中的使用导致部门内的大量积压，这些积压是对这些设备进行审查的。尽管有这样的积压，但前线官员经常抓住对调查几乎没有证据价值的设备。这也许并不令人惊讶，因为大多数数字证据都被一线官员所抓住，他们经常缺乏关于数字取证和技术的认识和培训。技术发展并适应用于犯罪的速度意味着即使是经过高级培训的人也很难保持最新状态。这可能导致规避风险的决策和“抓住所有”心态，从而增加数字法医积压。先前的研究和政府报告强调了与数字法医积压有关的问题，并强调了现有方法如何需要现代化以帮助解决该问题。数字设备分类是帮助减少积压的一种潜在方法。这是在犯罪现场评估数字设备以根据案件情况评估其调查价值的过程。被认为可能具有证据价值的设备将被扣押并提交给数字取证实验室进行深入检查和分析。尽管这种方法可能有效地减少了查获的设备数量，但存在不一致的方法来制定决策的风险，而数字意识降低会降低决策效率。该项目通过为开发智能数字法医顾问工具的基础奠定基础，迈出了第一步，以支持进行数字证据分类的急救人员。要做到这一点，我们将探索在两种不同的犯罪类型中搜索和搜查数字设备的搜索和扣押过程中的现有实践，资源，挑战和用户需求。通过此，我们将确定可用于告知智能顾问工具的数据，以及该工具本身可以解决的数据差距。由于工具有助于塑造决策的潜力，我们还将探索其使用的法律和道德意义。最后，利用我们的发现，我们将开发一组早期的低保真原型，以呈现给我们的用户组。