Towards a Smart Digital Forensic Advisor to Support First Responders with At-Scene Triage of Digital Evidence Across Crime Types

超过90%的报告犯罪涉及数字设备，并且在犯罪中越来越多地使用数字设备导致法医检查这些设备的部门内的大量积压。尽管有这种积压，前线官员经常没收对调查没有什么证据价值的设备。这也许并不令人惊讶，因为大多数数字证据都是由前线官员查获的，他们往往缺乏对数字取证和技术的认识和培训。技术发展的速度和适用于犯罪的速度意味着即使是那些受过高级培训的人也很难跟上时代。这可能导致规避风险的决策和“抓住一切”的心态，增加数字取证积压。先前的研究和政府报告强调了与警务中数字取证积压相关的问题，并强调了现有方法如何需要现代化以帮助解决问题。数字设备分类是帮助减少积压的一种潜在方法。这是在犯罪现场评估数字设备的过程，以根据案件的情况评估其调查价值。被认为可能具有证据价值的设备将被扣押并提交给数字取证实验室进行深入检查和分析。虽然这种方法可能有效地减少了被扣押的设备数量，但存在分类决策方法不一致的风险，以及数字意识低降低决策有效性的风险。该项目为解决这一问题迈出了第一步，为开发智能数字取证顾问工具奠定了基础，以支持现场急救人员进行数字证据分类。为此，我们将探索现有的做法，资源，挑战和用户需求，围绕两种不同犯罪类型的数字设备的搜索和扣押过程。通过这一点，我们将确定可用于通知智能顾问工具的数据，以及工具本身可以解决的数据差距。我们还将探讨其使用的法律的和道德的影响，由于该工具的潜力，帮助塑造决策。最后，根据我们的研究结果，我们将开发一套早期的低保真原型，以展示给我们的用户群体。

Over 90% of reported crime involves a digital device, and the increased use of digital devices in criminality has resulted in significant backlogs within the departments that forensically examine these devices. Despite this backlog, front-line officers often seize devices that have little evidential value to an investigation. This is perhaps unsurprising, as most digital evidence is seized by front-line officers who often lack awareness and training around digital forensics and technology. The speed at which technology develops and is adapted for use in criminality means that even those with advanced training can struggle to stay up to date. This can lead to risk-averse decision-making and a "seize all" mentality, increasing the digital forensic backlog. Prior research and government reports highlight the issues related to the digital forensic backlog within Policing and highlight how existing approaches are in need of modernisation to help address the problem. Digital device triage is one potential way of helping to reduce the backlog. This is the process of evaluating digital devices at a crime scene to assess their investigative value based on the circumstances of the case. Devices deemed likely to be of evidential value would be seized and submitted to a digital forensics lab for in-depth examination and analysis. While this approach may be effective in reducing the number of devices seized, there is a risk of inconsistent approaches to triage decision-making, and low digital awareness reducing decision-making effectiveness. This project makes a first step in addressing this, by laying the foundations for developing a smart digital forensic advisor tool to support first responders conducting digital evidence triage at-scene.To do this, we will explore existing practices, resources, challenges, and user needs around the process of search and seizure of digital devices across two distinct crime types. Through this, we will identify data that could be used to inform the smart advisor tool, and data gaps that the tool itself could address. We will also be exploring both the legal and ethical implications of its use, due to the tool's potential in helping to shape decision-making. Finally, drawing on our findings we will develop a set of early-stage low-fidelity prototypes to present back to our user groups.