“Scaffolding” responses to digital forensic inquiries

Abstract

As part of their role, digital forensic practitioners are often faced with casespecific investigative inquiries which they must attempt to address and provide an appropriate answer to their client. Such investigative questions can take many forms wherein every instance, any response they offer must be reliable. To be reliable, any response to an inquiry must be derived from justifiable and robust processes and information, coined here as the underpinning "scaffolding." This work offers a discussion of response scaffolding, what it is and why it is required in digital forensics with the three ways that this can be achieved outlined-via "past experience," "targeted testing" or through reference to appropriate "existing bodies of knowledge." Each one is examined in turn and their use is demonstrated via an overarching hypothetical example which is deployed and utilized throughout the analysis narrative for illustrative purposes.

Quality Assurance in Digital Forensic Investigations: Optimal Strategies and Emerging Innovations

“…Quality control is crucial for digital forensic investigations to provide accurate, trustworthy, and defendable results. Practitioners can protect professional standards, improve the admissibility of digital evidence, and preserve the public's trust in the objectivity of the investigation process by applying strict quality control methods [13]. The value of following best practices, standardizing procedures, and the function of accreditation and certification organizations in assuring the calibre of digital forensic investigations.…”

Who is the digital forensic expert and what is their expertise?

“…Experiential expertise may in some cases be considered the “gold standard” for an expert—that is, knowledge and expertise gained through past experiences, yet some caution must be exercised upon those claiming such routes to being an expert (Horsman, 2021). While in some cases, a practitioner may have carried out hundreds of examinations, building up a portfolio of practice, portions of this past experience may not always be useful when interpreting data in future cases.…”