The importance of digital evidence strategies

As the complexity of digital forensic work continues to grow, and the demands and pressures placed on practitioners to complete their investigatory commitments remain, methods for conducting effective and efficient work are of paramount importance. To combat examination challenges any investigating team requires two fundamental and linked components; those conducting DF examinations should develop (1) a digital evidence strategy (DES) that outlines an effective investigative approach, and, (2) deploy it using appropriate tools and techniques. While these should be considered as a pair, arguably as tools have become more comprehensive and more akin to “suites,” there is a real risk that tools themselves are being considered an “examination strategy,” bypassing the need for investigative forethought. Given this concern, through the vehicle of an example deconstructed hypothetical forensic examination process, this work discusses the relationship between DESs and digital forensic tools, and the importance of both.