Premium
Inter‐regional digital forensic knowledge management: needs, challenges, and solutions
Author(s) -
Casey Eoghan,
Zehnder Anna
Publication year - 2021
Publication title -
journal of forensic sciences
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.715
H-Index - 96
eISSN - 1556-4029
pISSN - 0022-1198
DOI - 10.1111/1556-4029.14613
Subject(s) - digital evidence , law enforcement , digital forensics , cybercrime , knowledge management , consistency (knowledge bases) , criminal investigation , computer science , computer security , the internet , political science , law , world wide web , artificial intelligence
Increasing demand for digital evidence in criminal investigations is driving decentralization of forensic capabilities closer to the crime scene. Law enforcement agencies are struggling to keep pace with technological developments, cybercrime growth, and scientific advances. In federated environments, digital forensic knowledge and practices vary widely across regions. To reduce delays, wasted resources, missed opportunities, mistakes, and misinterpretations, there is a pressing need to balance the democratization of digital forensic capabilities with knowledge management and sharing between decentralized regions. There are multiple forms of knowledge to be managed, including procedural, technical, investigative, scientific, behavioral, crime analysis, and forensic intelligence. In addition, there are multiple knowledge producers and consumers, including police investigators, digital forensic practitioners, criminal intelligence analysts, attorneys, and judges. Knowledge management becomes even more challenging when multiple interdependent regions are involved, speaking different languages. Taking all of these factors into consideration, this work presents an inter‐regional knowledge management solution for improving the quality, consistency, reliability, efficiency, cost‐effectiveness, and return on investment of digital forensic capabilities. The basis of this work is a community‐driven initiative of Swiss regional police authorities. Interviews were conducted with 15 digital forensic units to determine their current knowledge management practices and needs. The results were then generalized into a prioritized set of requirements for inter‐regional digital forensic knowledge management that may be applicable in other countries. These requirements were used to evaluate knowledge management platforms, and one was selected. Implementation, operations, and maintenance challenges of an inter‐regional digital forensic knowledge management platform are discussed.