Increasing digital investigator availability through efficient workflow management and automation

摘要

The growth of digital storage capacities and diversity devices has had asignificant time impact on digital forensic laboratories in law enforcement.Backlogs have become commonplace and increasingly more time is spent in theacquisition and preparation steps of an investigation as opposed to detailedevidence analysis and reporting. There is generally little room for increasingdigital investigation capacity in law enforcement digital forensic units andthe allocated budgets for these units are often decreasing. In the context ofdeveloping an efficient investigation process, one of the key challengesamounts to how to achieve more with less. This paper proposes a workflowmanagement automation framework for handling common digital forensic tools. Theobjective is to streamline the digital investigation workflow - enabling moreefficient use of limited hardware and software. The proposed automationframework reduces the time digital forensic experts waste conductingtime-consuming, though necessary, tasks. The evidence processing time isdecreased through server-side automation resulting in 24/7 evidencepreparation. The proposed framework increases efficiency of use of forensicsoftware and hardware, reduces the infrastructure costs and license fees, andsimplifies the preparation steps for the digital investigator. The proposedapproach is evaluated in a real-world scenario to evaluate its robustness andhighlight its benefits.