Towards a Smart Digital Forensic Advisor to Support First Responders with At-Scene Triage of Digital Evidence Across Crime Types

打造智能数字取证顾问，支持急救人员对不同犯罪类型的数字证据进行现场分类

• 批准号: ES/Y010647/1
• 负责人: Mark Warner
• 金额: $ 57.45万
• 依托单位: University College London
• 依托单位国家: 英国
• 项目类别: Research Grant
• 财政年份: 2024
• 资助国家: 英国
• 起止时间: 2024 至 无数据
• 项目状态: 未结题
• 来源: https://gtr.ukri.org/projects?ref=ES%2FY010647%2F1
• 关键词: Towards; Smart; Digital; Forensic; Advisor

Over 90% of reported crime involves a digital device, and the increased use of digital devices in criminality has resulted in significant backlogs within the departments that forensically examine these devices. Despite this backlog, front-line officers often seize devices that have little evidential value to an investigation. This is perhaps unsurprising, as most digital evidence is seized by front-line officers who often lack awareness and training around digital forensics and technology. The speed at which technology develops and is adapted for use in criminality means that even those with advanced training can struggle to stay up to date. This can lead to risk-averse decision-making and a "seize all" mentality, increasing the digital forensic backlog. Prior research and government reports highlight the issues related to the digital forensic backlog within Policing and highlight how existing approaches are in need of modernisation to help address the problem. Digital device triage is one potential way of helping to reduce the backlog. This is the process of evaluating digital devices at a crime scene to assess their investigative value based on the circumstances of the case. Devices deemed likely to be of evidential value would be seized and submitted to a digital forensics lab for in-depth examination and analysis. While this approach may be effective in reducing the number of devices seized, there is a risk of inconsistent approaches to triage decision-making, and low digital awareness reducing decision-making effectiveness. This project makes a first step in addressing this, by laying the foundations for developing a smart digital forensic advisor tool to support first responders conducting digital evidence triage at-scene.To do this, we will explore existing practices, resources, challenges, and user needs around the process of search and seizure of digital devices across two distinct crime types. Through this, we will identify data that could be used to inform the smart advisor tool, and data gaps that the tool itself could address. We will also be exploring both the legal and ethical implications of its use, due to the tool's potential in helping to shape decision-making. Finally, drawing on our findings we will develop a set of early-stage low-fidelity prototypes to present back to our user groups.

超过 90% 的已报告犯罪涉及数字设备，而数字设备在犯罪活动中使用的增加导致对这些设备进行取证检查的部门出现大量积压。尽管存在积压，一线官员仍经常没收对调查几乎没有证据价值的设备。这也许并不奇怪，因为大多数数字证据都是由一线官员掌握的，他们往往缺乏对数字取证和技术的认识和培训。技术发展和适应犯罪的速度之快意味着即使是那些接受过高级培训的人也很难跟上时代的步伐。这可能会导致规避风险的决策和“抓住一切”的心态，从而增加数字取证积压。先前的研究和政府报告强调了与警务领域数字取证积压相关的问题，并强调现有方法需要现代化以帮助解决该问题。数字设备分类是帮助减少积压的一种潜在方法。这是在犯罪现场评估数字设备以根据案件情况评估其调查价值的过程。被认为可能具有证据价值的设备将被没收并提交给数字取证实验室进行深入检查和分析。虽然这种方法可能有效减少扣押设备的数量，但存在分类决策方法不一致以及数字意识低下降低决策有效性的风险。该项目在解决这个问题上迈出了第一步，为开发智能数字取证顾问工具奠定了基础，以支持急救人员在现场进行数字证据分类。为此，我们将探索现有的实践、资源、挑战和用户围绕两种不同犯罪类型搜查和扣押数字设备过程的需求。通过这一点，我们将确定可用于通知智能顾问工具的数据，以及该工具本身可以解决的数据差距。由于该工具在帮助制定决策方面具有潜力，我们还将探讨其使用的法律和道德影响。最后，根据我们的发现，我们将开发一套早期低保真原型，以呈现给我们的用户组。