Part 2 - Core Stages in the Journey

At first sight, it can be tempting to imagine this journey as a simple straight line. In reality, it is not linear. Information often moves back and forward. Questions may be revised. New leads may change priorities. Investigators may ask analysts to clarify a point. Analysts may need more precise information before they can proceed. What Clarus highlights is that each stage builds on the previous one, but also depends on communication between stages. This means the journey of digital evidence is more like a set of linked loops than a single linear one-way path.  

The core stages can be described like this.

• In the first response stage, officers secure the scene and identify potential evidence. 
• In the crime scene investigation stage, specialists and investigators document the scene and collect evidence.
• In the criminal investigation stage, decisions are made about priorities, legal powers, and requests for forensic work.
• In the digital forensic stage, devices are processed and analysed, and formal findings are produced.
• Finally, the outputs are integrated into the broader investigation and may form part of the material presented later in the justice process.  

It is worth noting that there may be some variation in these stages in certain countries. 

All stages depend on communication, but the handover points are especially important. These are the moments where information is translated, narrowed, clarified, or passed on. That is why Clarus pays close attention to requests, reports, informal clarification, and the timing of information sharing

As evidence moves through these stages, the wording of a question between stages and the wording of requests for analysis may all shape the usefulness of the evidence later. 

Clarus identifies several vulnerabilities in this process.  Language may be oversimplified in a way that loses technical nuance, or made so complex that others place too much confidence in what the evidence can do. Task-irrelevant information may also reach analysts and influence interpretation. These are not just technical issues. They are system and communication issues. 

Move to the next page by clicking the arrow on the top right to move to the next page in this section.