Redefining the Value of Digital Evidence in Creating Actionable Intelligence

66% of agency managers agreed digital evidence is more important than physical evidence and DNA in successfully prosecuting cases.¹

Digital evidence has become a critical aspect of modern investigations, whether it is in the context of law enforcement, corporate investigations, or intelligence gathering. The exponential growth of digital data has led to a corresponding increase in the value of digital evidence. The value of digital evidence is not only in the data itself but also in the insights that can be gained from it. However, the traditional approach to collecting, analyzing, and presenting digital evidence has not kept up with the pace of technological change. This paper will explore how redefining the value of digital evidence can help create actionable intelligence by focusing on people, processes, platforms, and promises.

Introduction

81% of agency managers agree digital evidence significantly increases the case closure rate.¹

Since its introduction, the primary objective of digital forensics has been the creation of a top-down single source of truth from which agencies would gain access to mobile device data and provide investigative intelligence from the evidence with static reports.

With the focus on delivering digital data, digital forensics vendors began to approach the problem in the same manner as traditional IT projects, where the business creates the solution by emphasizing a linear progression from the beginning to the end of a project.

While this supplier/consumer approach to digital data access appeared to be well-suited for the task of centralizing a mobile device’s data and promoting consistency, it sacrificed digital evidence reporting agility.

There was a significant lag between the time the digital data was accessed, and the time the digital evidence was available for review. This delay and lack of agility within the analysis process led to a mobile device examination backlog and lowered the overall investigation impact.

The emergence of decrypting and decoding data as it is accessed has challenged the status quo, especially for digital forensics professionals who have spent the better part of their careers using an infrastructure designed for developing top-down, centralized reporting, and dashboards. With the simultaneous extraction and decoding trend starting, the focus remained on producing a centrally managed single source of truth for the agency.

Today decrypting and decoding data as it is accessed is the new normal. The traditional approach to digital data intelligence is becoming less and less relevant as the agencies demand the agility that comes with simultaneous decrypting and decoding of digital data to drive faster investigations and improved prosecutorial outcomes. This, paired with the continued exponential growth in data volume and complexity, presents agencies with an important choice.

As agencies begin the transition from a traditional top-down approach to a simultaneous decrypting and decoding of digital data approach enabled by digital forensic vendors, a new framework and overall strategy are required. This means that past decisions supporting the core foundational components of a digital data intelligence program—people, process, and platform—must be revisited. Adjustments are needed in these three core areas to support the shift from a model of top-down mobile device data extraction and delivery to simultaneous decrypting and decoding of the digital data approach.

People

74% of agency managers identified a need for personnel with the required IT and technical skills.¹

The value of digital evidence lies in the ability to interpret it, draw insights from it, and act based on those insights. The importance of skilled and knowledgeable people in the digital evidence process cannot be overstated. Digital investigations require individuals with a deep understanding of technology, digital forensics, data analytics, forensic analysis, and legal procedures. They must be able to sift through vast amounts of data to identify relevant information and then present their findings in a clear and concise manner.

Additionally, the role of the examiner is changing. In the past, the examiner was primarily responsible for collecting and analyzing data. However, with the rise of artificial intelligence and machine learning, examiners and investigators must also be proficient in these technologies to effectively leverage them in their investigations.

Examiners and investigators need to use analytics for them to improve the digital evidence impact and deliver case closure value. A modernized actionable intelligence model that embraces simultaneous decrypting and decoding of digital data allows them to explore, discover, and build content that they will ultimately use to make faster and better investigative decisions.

Collaboration between the examiners and investigators is critical to the success of the actionable intelligence implementation, as the examiner knows how to manage data and the investigator knows how to interpret and use data within the digital forensic process they support. They have the context within which analytics and the insight derived from it will be used to make better case decisions and ultimately improve prosecutorial outcomes.

Process

52% of law enforcement professionals agree they lack the proper tools to perform their job optimally.¹

The process of collecting, analyzing, and presenting digital evidence is critical to creating actionable intelligence. Traditionally, this process has been linear, with examiners and investigators using a variety of tools and techniques to collect data from different sources. However, this approach can lead to inconsistent results and makes it challenging to identify patterns or trends.

A more effective approach is to use an integrated process that leverages automation and machine learning. By automating routine tasks such as data collection and analysis, examiners and investigators can focus on more complex and strategic tasks that require human intervention. Machine learning algorithms can be used to identify patterns and anomalies in large data sets, providing insights that would be difficult for humans to identify.

Additionally, agencies should embrace agile methodologies that prioritize flexibility, collaboration, and rapid digital evidence iteration.

A successful modern digital forensics solution can deliver both advanced digital data access and fast time to digital evidence review. A well-established and well-communicated digital forensics workflow process is required for agencies to achieve these results.

A top-down, waterfall-based process only addresses the digital data access part of the equation. A traditional digital forensics deployment focuses primarily on accessing and reporting digital evidence content. This means waiting for the decoding of the data to build the reports and dashboards.

The unfortunate reality is that this approach often fails to deliver on the vision and promise of actionable intelligence—to deliver significant and tangible value to the agency through improved decision-making with minimal time, effort, and cost.

The digital forensics solution success is highlighted when the agencies can benefit from actionable intelligence. Traditional processes intended to serve top-down digital forensics deployments are too often measured by metrics that are not tied to agency impact. If the digital data extraction ran without failure and the digital evidence was loaded without error and all downstream reports were refreshed, many digital forensics vendors would consider themselves successful.

Merely supplying data and content to examiners and investigators without any regard for whether it provides actionable value through improved defined outcomes is simply not enough. Modern digital forensics requires updated processes to support the simultaneous decrypting and decoding of digital data. It also requires the definition of new success metrics in which digital forensics vendors and agencies are equally invested, such as speed to and value of actionable intelligence in improving the case closure rate.

Where processes and technology intertwine, there is a tremendous opportunity. Technical innovations, especially with actionable intelligence, will continue to make it easier to automate processes and augment users of all skill levels throughout the digital forensic workflow.

Platform

47% of agency managers said they are receptive to storing and managing evidence and investigative processes in the cloud.¹

The platform used for digital evidence analysis is a critical component of the process. It must be able to handle large amounts of data from a variety of sources and provide powerful analysis tools to identify relevant information. Additionally, the platform must be secure and compliant with relevant regulations to ensure the integrity of the data.

Agencies should invest in platforms that are scalable, flexible, and interoperable. This includes tools for data integration, visualization, and machine learning, as well as secure storage and sharing capabilities. Additionally, agencies should prioritize platforms that can adapt to changing technology trends and emerging threats.

Cloud-based platforms are becoming increasingly popular for digital evidence analysis, as they offer scalability, flexibility, and cost-effectiveness. Additionally, cloud-based platforms can provide powerful artificial intelligence and machine learning capabilities that would be more difficult to implement on-premises.

A modern platform must address a wide range of needs and different personas, the increased pace of agency workload, and the exponential growth in data volume and complexity. Agencies require that the digital forensics platform enables governance and security while end users require easy access to digital data content and the ability to discover and explore digital evidence.

The digital forensics platform must also be able to evolve with the landscape and integrate easily with other systems within an agency.

The most critical aspect is the ability to meet these diverse needs in an integrated and intuitive way. This integration is depicted in the image below as the modern digital forensic workflow. The diagram highlights the key capabilities that must flow seamlessly for the examiners and investigators to effectively leverage the platform.

Promise

74% of agency managers agreed prosecutors are more confident in cases with digital evidence.¹

The promise of redefining the value of digital evidence is the creation of actionable intelligence that can drive real-world outcomes. By leveraging skilled people, an integrated process, and powerful platforms, digital evidence can be transformed into actionable insights that drive better decision-making. This can have significant benefits across a variety of industries, including law enforcement, corporate investigations, and intelligence gathering.

One of the most significant benefits of actionable intelligence is the ability to identify and respond to threats more quickly. In law enforcement, this can mean solving crimes more efficiently and preventing future crimes. In the corporate world, actionable intelligence can help identify and mitigate risks to the organization, such as fraud or cyberattacks. In intelligence gathering, actionable intelligence can help identify emerging threats and enable proactive measures to prevent them.

To improve public safety, prevent crime and terrorism, and protect national security, agencies must prioritize outcomes over outputs, focusing on the impact of their work rather than just the quantity of data collected or analyzed.

Realizing the value of actionable data for digital transformation efforts, many agencies are modernizing and increasing their analytics investments to innovate and accelerate change. Everyone agrees that putting data at the center of conversations improves outcomes.

Digital forensic vendors are well positioned for a leadership role in these efforts and are essential for the task of giving examiners and investigators the relevant actionable intelligence they need for faster decision-making. Modern analytics shifts the digital forensics vendor’s role to a more strategic partner for the agencies by empowering examiners and investigators to navigate a secure, self-service environment.

Success at scale relies on a systematic, agile approach to identifying key sources of digital evidence, how data is selected, managed, distributed, consumed, and secured, and how examiners and investigators are educated and engaged.

Conclusion

95% of investigators agree digital evidence greatly increases case solvability.¹

Redefining the value of digital evidence requires an integrated approach that encompasses people, processes, platforms, and promises. By leveraging skilled individuals, integrated processes, and powerful platforms, digital evidence can be transformed into actionable intelligence that drives better decision-making. The benefits of actionable intelligence are significant, and it is essential that organizations embrace this approach to stay ahead in an increasingly complex and data-driven world.

By investing in these areas, agencies can create actionable intelligence that drives real‑world outcomes and improves our community’s and nation's safety and security.

References

 [1] “2022 Industry Trends Survey for Law Enforcement”, Cellebrite DI Ltd., https://cellebrite.com/en/2022-industry-trends-form/, 2022

About the Author:

Larry Wolter is a Senior Product Marketing Manager at Cellebrite. Larry has over 20 years of experience in creating industry-first, high-technology product and service solutions for the enterprise and federal government vertical markets. Larry’s strong leadership in developing performance-based processes and procedures has resulted in several company acquisitions, both pre-IPO and post-IPO. He specializes in strategic product marketing planning and customer-focused sales enablement for managed digital transformation, cybersecurity, and network infrastructure solutions. Prior to Cellebrite, Larry worked as the Marketing Director of Networking For Future (NFF). Larry’s recent experience also includes senior strategic product marketing roles at Personal Connected Health Alliance, Livanta, Metalogix Software, Riverbed Technology, and Motorola Solutions.

Larry received a Master of Science degree in Engineering Management from the University of Massachusetts and a Bachelor of Science degree in Electrical Engineering from Purdue University.