Towards a Smart Digital Forensic Advisor to Support First Responders with At-Scene Triage of Digital Evidence Across Crime Types

超过90%的犯罪报告涉及数字设备，数字设备在犯罪活动中的使用越来越多，导致对这些设备进行法医检查的部门大量积压。尽管有这么多积压，但一线官员经常没收对调查几乎没有证据价值的设备。这也许并不奇怪，因为大多数数字证据都是由一线官员掌握的，而他们往往缺乏对数字取证和技术的认识和培训。技术发展的速度和被用于犯罪的速度意味着，即使是受过高级培训的人也很难跟上时代的步伐。这可能导致规避风险的决策和“抓住一切”的心态，从而增加数字取证的积压。先前的研究和政府报告强调了与警务部门数字法医积压相关的问题，并强调了现有方法如何需要现代化以帮助解决问题。数字设备分类是帮助减少积压的一种潜在方法。这是对犯罪现场的数字设备进行评估的过程，根据案件的情况评估其调查价值。被认为可能具有证据价值的设备将被没收并提交给数字取证实验室进行深入检查和分析。虽然这种方法可能有效地减少被查获的设备数量，但存在分类决策方法不一致的风险，并且低数字意识会降低决策的有效性。该项目为解决这一问题迈出了第一步，为开发智能数字法医顾问工具奠定了基础，该工具可支持现场急救人员进行数字证据分类。为此，我们将探讨现有的做法、资源、挑战和用户需求，围绕两种不同犯罪类型的搜索和扣押数字设备的过程。通过这种方式，我们将确定可用于通知智能顾问工具的数据，以及工具本身可以解决的数据缺口。由于该工具在帮助制定决策方面的潜力，我们还将探索其使用的法律和伦理影响。最后，根据我们的发现，我们将开发一套早期低保真原型，以呈现给我们的用户群体。

Over 90% of reported crime involves a digital device, and the increased use of digital devices in criminality has resulted in significant backlogs within the departments that forensically examine these devices. Despite this backlog, front-line officers often seize devices that have little evidential value to an investigation. This is perhaps unsurprising, as most digital evidence is seized by front-line officers who often lack awareness and training around digital forensics and technology. The speed at which technology develops and is adapted for use in criminality means that even those with advanced training can struggle to stay up to date. This can lead to risk-averse decision-making and a "seize all" mentality, increasing the digital forensic backlog. Prior research and government reports highlight the issues related to the digital forensic backlog within Policing and highlight how existing approaches are in need of modernisation to help address the problem. Digital device triage is one potential way of helping to reduce the backlog. This is the process of evaluating digital devices at a crime scene to assess their investigative value based on the circumstances of the case. Devices deemed likely to be of evidential value would be seized and submitted to a digital forensics lab for in-depth examination and analysis. While this approach may be effective in reducing the number of devices seized, there is a risk of inconsistent approaches to triage decision-making, and low digital awareness reducing decision-making effectiveness. This project makes a first step in addressing this, by laying the foundations for developing a smart digital forensic advisor tool to support first responders conducting digital evidence triage at-scene.To do this, we will explore existing practices, resources, challenges, and user needs around the process of search and seizure of digital devices across two distinct crime types. Through this, we will identify data that could be used to inform the smart advisor tool, and data gaps that the tool itself could address. We will also be exploring both the legal and ethical implications of its use, due to the tool's potential in helping to shape decision-making. Finally, drawing on our findings we will develop a set of early-stage low-fidelity prototypes to present back to our user groups.