Methods and Factors Affecting Digital Forensic Case Management, Allocation and Completion

Abstract

Modern Digital Forensic (DF) departments/sections are witnessing rapid increase in digital forensic cases through the years. The challenges of DF cases investigation are getting more robust and they are affecting digital forensic investigation processes. Accordingly, understanding different factors affecting Person-Hours of investigation from real cases records, and recognising the context of work with different strategies and practices performed in different departments. It is necessary to create a stable ground to face all the factors affecting the investigative processes.
This research detailsthe cases’ trends in the D¬ubai Police. It also identifies the main challenges encountered by DF including rising volumes of data, and case complexity, using real case records from the Dubai Police, this extensive research explains the contribution of several factors to the delay in the DF investigation process. The research also elucidates the context of work of DF departments in other locations and other countries to understand a range of case allocation strategies and case management procedures. The research contributes a set of Decision Tables that could be used by DF managers and supervisors to select best proposed case allocation strategies and case management procedures.
The research is accomplished through a series of three studies referred to as Study One, Study Two, and Study Three. Study One (Investigation of the Dubai Police Records) involves a quantitative analysis of secondary data in the form of case records from the Dubai Police (DP) Database and associated reports. This study addresses the first research question (RQ1): “What are the trends and challenges encountered by practitioners faced with large volume/heterogeneity DF investigations?” by measuring the growth of cases and identifying the main factors for the delay in DF investigations. Study Two (Interviews with DF managers) follows a qualitative approach using the phenomenological model, and covers the second research question (RQ2): “What are the effect of different factors behind the delay of DF investigation process?” The study identifies the common factors affecting delay in DF investigations, from the diverse experiences and backgrounds of DF decision makers around the world. Study Three (Confirmation of the Interviews) again uses the phenomenological model, and covers the third research question (RQ3): “What are the different case management procedures and workflow implementation practices currently used?" This study evaluates the efficacy of different case allocation strategies and workflow implementation practices with selected participants and results in a contribution to DF in the form of a series of Decision Tables for case allocation.
The main findings of the research explain the main factors that lead to the creation of delay in DF investigation and thereafter affect the DF investigation process. Moreover, this research identifies case management strategies and workflow implementation practices. The research also suggests several Decision Tables to allow managers and people who are in charge to select a case management strategy and workflow implementation depending on several conditions.