Having just attended a big conference in the USA, it became even more apparent how we are separated by a common language!
The term ‘triage’ as applied to digital devices seems to involve quite a different process in the USA when compared to the understanding of the term here in the UK. I attended a presentation of a new ‘triage’ tool that is made available free to law enforcement and military customers and I must say it was a brilliant product…. BUT I don’t think it’s what we understand a triage tool to be. The reason? It only works on forensic images of a target device and usually runs overnight! This makes it what I would call an “Early Case Assessment” tool and not a triage solution. The two tasks are quite different for two reasons: Speed and Functionality
Out in the field, where time is of the essence, a triage process should be conducted to quickly help the first responder classify and prioritise devices that the experts need to examine. Once in the forensic lab and with the luxury of more time, an “early case assessment” process can automate many of the time consuming tasks a forensic expert would normally spend hours performing like carving file fragments, extracting and reporting relevant email, identifying event sequences, generating a standard case report etc.
The ‘early case assessment’ tool I witnessed looked very impressive and I’m sure would be of great benefit to forensic analysis in speeding up initial case reviews and I’m happy to pass on details to relevant organisations. Likewise, if your lab is already suffering long delays caused by volumes of unnecessary device seizures then I’m happy to discuss how SPEKTOR Forensic Intelligence and SPEKTOR Phone Intelligence can eliminate these delays and help you focus on what you do best. Call us now for more information. +44(0)845 125 4400
info@evidencetalks.com
