The Impact of Automation of Digital Forensic Investigations on Evidence in Criminal Proceedings

Abstract

This article provides a brief insight into the challenges and dilemmas posed in the field of digital forensics by the steady increase of the number of electronic devices and their storage capacities, the ubiquitous use and connection of these devices, and the large amount of data they create. Digital forensic investigations today often involve a large number of devices and huge amounts of data. Due to limited personal and technical resources, many countries worldwide face investigative backlogs that negatively affect the principle of a trial occurring within a reasonable time. The investment of time and resources in a digital forensic investigation is often disproportionate to the results of this investigation, as more devices and data do not necessarily mean more digital evidence but only more material to be investigated. The needle, therefore, remains mainly the same, but the haystack in which it is sought is growing. One of the solutions being developed to address this problem is the (partial) automation of digital forensic investigations. This article presents a theoretical analysis of the current situation in this field, with special attention given to the question of how automation (i.e., machine or programmed investigation) impacts the reliability of such an investigation for the need of criminal proceedings. Until the concept of validation and formal verification of digital forensic tools is established globally, it is important for digital forensic researchers to have full control over all phases of the digital forensic investigation; and for decision-makers in criminal proceedings (especially public prosecutors and judges) to be aware of both the advantages and disadvantages of (partly) automated digital forensic tools.