The mobile forensics landscape is evolving at an exponential rate, writes Yuval Ben-Moshe, senior forensics technical director at Cellebrite
Advances in new technology and functionality mean practitioners must constantly adapt to match the realities of ever-increasing workloads coming in from the investigative field.
Mobile forensic investigators working in laboratories are continuously overstretched and the demands being placed on them are causing a substantial backlog. The change that must occur to resolve this is a transfer of certain responsibilities from lab investigators to first responder-level professionals and other law enforcement staff in the field.
The forensic process, which includes the collection and analysis of data, is embarking on an era of ‘decentralisation’. Overloaded organisations require urgent tasks, such as forensic collections, to be completed by non-specialist staff, alleviating the pressure and allowing specialised investigators to focus on the data and complex cases that require their unique expertise.
A recent survey conducted by Cellebrite found that 44 per cent of their public sector users of mobile forensic technology extract data outside of the lab environment. This is a clear indication of how mobile forensic extraction is becoming decentralised and the changing responsibilities are becoming more evenly spread out. The tools and technologies are advancing so work can now be categorised and tiered, and field personnel can perform simpler but more urgent tasks, while forensics professionals can go deeper into more complex analytical work.
The general reaction to this change in mobile forensic responsibility is being recognised and embraced by the law enforcement community – delegating mobile forensic extraction to the field is not only a time-saving benefit for the forensic specialists, it’s also allowing field officers to have a direct involvement in the forensic process, where they can demonstrate their own expertise and perhaps offer an additional perspective.
Substantial advances that have been made in mobile forensic technology mean that in-field investigators don’t have to invest time retrieving the mobile device from a suspect and transporting it to a lab for forensic examination. The data extraction process can now be performed at the scene, at local police stations and in real time. In a kidnapping case, for example, investigators do not have time to send extracted data back to the lab to be analysed and then wait for the results. An extra hour could be the difference between life and death.
This is by no means the only benefit to moving initial data collection out of the lab and into the field. Investigators will generally have a better understanding of what types of data need to be extracted as they will have a first-hand insight into the case and evidence that may be needed.
The mass volumes of data that are being transferred between mobile devices, along with the amount that is stored, provide forensic investigators with an abundance of information that can be extracted and analysed during a criminal investigation. Although this wealth of data is extremely important in solving criminal cases as there is so much data, lab investigators are constantly inundated with requests for extraction and analysis.
However, by shifting some of these tasks from the lab to the field, specialists can focus on analysing critical data packages that require their unique expertise.
The value of decentralising the forensic process when it comes to mobile data extraction is hugely beneficial, not only to lab investigators but to the whole criminal investigation. By making the process more efficient and effective, and transferring certain tasks away from the lab, it will lead to more timely results which could potentially save lives.
