3 Digital Forensic Scientist
Digital devices such as computers and mobile phones are typically seized by non-expert police officers. Typically, they are seized from individuals, during property searches, and from scenes of crime. Seizing officers should follow procedures for the recovery of digital devices that helps to maintain the integrity of data held on those devices, while also considering device security features that can make them challenging to analyse later.
Digital forensic experts recover and analyse data stored on digital devices that have been seized, to identify salient evidence that could be used to progress an investigation and be presented and tested in court. Where possible, experts will make an exact copy of a device, analysing the copy to preserve the state of the original device. Data extracted from devices can include digital artefacts such as documents, emails, texts, instant messages, images, and internet history. Digital forensic experts are trained to use specialised software to help them identify digital evidence. They use techniques such as:
- keyword searches to find information containing specific words and terms
- file filtering to isolate files that match certain criteria (e.g., over a certain size, of a certain type such as a video)
- timeline analysis that helps in the identification of files and other digital artefacts that have been created, modified or accessed during specific periods of time.