Search results

Cyber-enabled crimes are on the increase, and law enforcement has had to expand many of their detecting activities into the digital domain. As such, the field of digital forensics has become far more sophisticated over the years and is now able to uncover even more evidence that can be used to support prosecution of cyber criminals in a court of law. Governments, too, have embraced the ability to track suspicious individuals in the online world. Forensics investigators are driven to gather data exhaustively, being under pressure to provide law enforcement with sufficient evidence to secure a conviction.

Yet, there are concerns about the ethics and justice of untrammeled investigations on a number of levels. On an organizational level, unconstrained investigations could interfere with, and damage, the organization's right to control the disclosure of their intellectual capital. On an individual level, those being investigated could easily have their legal privacy rights violated by forensics investigations. On a societal level, there might be a sense of injustice at the perceived inequality of current practice in this domain.

This paper argues the need for a practical, ethically grounded approach to digital forensic investigations, one that acknowledges and respects the privacy rights of individuals and the intellectual capital disclosure rights of organizations, as well as acknowledging the needs of law enforcement. The paper derives a set of ethical guidelines, and then maps these onto a forensics investigation framework. The framework to expert review in two stages is subjected, refining the framework after each stage. The paper concludes by proposing the refined ethically grounded digital forensics investigation framework. The treatise is primarily UK based, but the concepts presented here have international relevance and applicability.

In this paper, the lens of justice theory is used to explore the tension that exists between the needs of digital forensic investigations into cybercrimes on the one hand, and, on the other, individuals' rights to privacy and organizations' rights to control intellectual capital disclosure.

The investigation revealed a potential inequality between the practices of digital forensics investigators and the rights of other stakeholders. That being so, the need for a more ethically informed approach to digital forensics investigations, as a remedy, is highlighted and a framework proposed to provide this.

The proposed ethically informed framework for guiding digital forensics investigations suggests a way of re-establishing the equality of the stakeholders in this arena, and ensuring that the potential for a sense of injustice is reduced.

Justice theory is used to highlight the difficulties in squaring the circle between the rights and expectations of all stakeholders in the digital forensics arena. The outcome is the forensics investigation guideline, PRECEpt: Privacy-Respecting EthiCal framEwork, which provides the basis for a re-aligning of the balance between the requirements and expectations of digital forensic investigators on the one hand, and individual and organizational expectations and rights, on the other.

Purpose – The CSI effect, as it is referenced in mainstream media, is a purported effect on public perceptions caused by the portrayal of forensics and investigations in popular entertainment programming. Despite the obvious popularity of the programs – a common source of blame for such effects and the focus of limited prior research – impacts on perceptions by way of media content must be viewed as a product of multiple internal and external factors, rather than a result of popularity and viewership alone.

Methodology – By examining the portrayal of programming within the context of contemporary news publications, this project focuses on the value and context of presentations of forensics television programming across media genres, highlighting the bidirectional flow of popular media cues through various influential media outlets and outlining the potential for resulting public effects.

Findings – The authors find that an increase in the overall media visibility of entertainment images of forensic science, coupled with news media's tendency to tie such images to real-world forensics on the local and national scenes given an absence of alternative sources for news-oriented stories, speak to the importance of the holistic examination of the role of CSI-related programming in influencing popular perceptions.

The purpose of this paper is to propose a novel approach that automates the visualisation of both quantitative data (the network) and qualitative data (the content) within emails to aid the triage of evidence during a forensics investigation. Email remains a key source of evidence during a digital investigation, and a forensics examiner may be required to triage and analyse large email data sets for evidence. Current practice utilises tools and techniques that require a manual trawl through such data, which is a time-consuming process.

This paper applies the methodology to the Enron email corpus, and in particular one key suspect, to demonstrate the applicability of the approach. Resulting visualisations of network narratives are discussed to show how network narratives may be used to triage large evidence data sets.

Using the network narrative approach enables a forensics examiner to quickly identify relevant evidence within large email data sets. Within the case study presented in this paper, the results identify key witnesses, other actors of interest to the investigation and potential sources of further evidence.

The implications are for digital forensics examiners or for security investigations that involve email data. The approach posited in this paper demonstrates the triage and visualisation of email network narratives to aid an investigation and identify potential sources of electronic evidence.

There are a number of network visualisation applications in use. However, none of these enable the combined visualisation of quantitative and qualitative data to provide a view of what the actors are discussing and how this shapes the network in email data sets.

The purpose of this paper is to make recommendations to address the four limitations of Singapore’s Corrupt Practices Investigation Bureau (CPIB).

The paper begins by attributing Singapore’s reputation as the least corrupt Asian country to the CPIB’s four strengths: its independence from the police; its adequate staffing and funding; its adoption of the total approach to enforcement; and its impartial enforcement of the anti-corruption laws. It then proceeds to identify the CPIB’s limitations and provides four suggestions to address these limitations.

The sentencing of Edwin Yeo, a senior CPIB officer, to ten years’ imprisonment on 20 February 2014 for misappropriating US$1.76 million for nearly four years reveals that there were weaknesses in the CPIB’s internal controls and procurement procedures in spite of its effectiveness in curbing corruption. This paper recommends that the CPIB addresses its four limitations by strengthening its internal controls and procurement procedures; enhancing public trust and confidence by further improving its outreach to the population; improving the external oversight of its activities; and developing its in-house research capabilities.

This paper will be useful for those scholars, policy-makers, and anti-corruption practitioners who are interested in how the CPIB can further enhance its effectiveness even though Singapore is perceived as the least corrupt Asian country.

The purpose of this study is to develop an innovative approach of combating economic crime using the forensic accounting techniques.

The approach considered the identification of the effective forensic accounting techniques from the available literature and also explored the anti-economic crime policy, capable of assisting in the combating of economic crime. This brought about the development of two conceptual models, which incorporate all the requirements for the implementation of forensic accounting and the integration of forensic accounting technique into the organizational control system for effective fraud mitigation.

The analysis of the literature review indicated that one of the drawbacks, which has continue to mitigate the implementation of forensic accounting as a tool for combating fraud is lack of a suitable framework. This was the major focal point of this work, which produced two simplified conceptual models suitable for effective fraud mitigation.

This study is limited to the development of conceptual models for fraud mitigation only.

The simplified model can easily be adopted into the structure of an organization to provide a sustainable solution to mitigate fraud occurrences.

The novelty of this study lies in the development of two simplified conceptual models. The first model addressed the incorporation of forensic accounting into the organization structure while the second captured the detailed investigation and comprehensive data analysis processes of uncovering fraud. The development of conceptual models with all these peculiarities for fraud mitigation has not been widely reported by the existing literature.

This study identifies the policing pre-deployment training content for Korean experts based on needs assessments. Korean policing is at an excellent level to transfer knowledge and skills. Pre-deployment training should be designed systematically and training of trainers approaches should be implemented.

This study used T-tests, Borich needs assessments, and Locus for Focus model analyses to determine the priorities of needs for pre-deployment training in policing. A survey of 116 experienced experts was conducted, with 87 responding (75%).

The study identified 26 factors that deployed law enforcement professionals want to learn from pre-deployment training. These factors were categorized into three areas: research, training design and methods and understanding of partner countries and international development cooperation. The nine highest priorities for training needs were related to understanding the status and conditions of police training in the country to which policing experts are deployed.

This study was limited to Korean policing experts. And the study did not evaluate the validity of the training curriculum or indicators.

Technical assistance in international policing development cooperation aims to train future trainers who can train local police. This study found that limited learner information and poor communication skills can lead to ineffective technical assistance.

This study highlights the importance of knowledge transfer and effective pre-deployment training for policing. The findings can be used to improve training programs and police human resource development.

To explore the meaning, methods and techniques associated with the subject of computer forensics and consider the implications of computer forensics for records managers and recordkeeping.

Critically analyses the principles of computer forensics in the context of records characteristics – authenticity, reliability, integrity and usability – and the UK Association of Chief Police Officers (ACPO) principles and procedures for the collection of digital evidence.

The disciplines of records management and computer forensics are potentially mutually compatible. Computer forensics allows for identification of incidents, gathering of evidence, analysis of evidence and potentially recovery of records. Records managers can utilise computer forensics principles to positively enhance records management and have valuable knowledge and expertise to share with their computer forensics colleagues; e.g. metadata expertise, functional requirements for electronic records management, recordkeeping systems design and implementation methodologies, digital preservation and retention management.

Discusses how computer forensics can be used to highlight inadequate recordkeeping and provide a different perspective on records management based on an analysis of principles and concepts rather than empirical data.

Highlights the need for records managers to understand computer forensics and computer forensic scientists to understand recordkeeping to support better records management in the electronic environment; raises the implications for educators, trainers and professional societies.

Very little has been published on the discussion of the potential implications of computer forensics for records managers or how computer forensics can enhance the records management discipline; this paper addresses the gap.

In-depth knowledge about specific national approaches to using digital evidence in investigations is scarce. A clearer insight into the organisational barriers and professional challenges experienced, alongside a more detailed picture of how digital evidence can help police investigations are required to empirically substantiate claims about how digital technologies are changing the face of criminal investigations. The paper aims to focus on the introduction of digital media investigators to support investigating officers with the collection and interpretation of digital evidence.

Drawing on ethnographic and interview data collected as part of an Economic and Social Research Council-funded project on the application of digital forensics expertise in policing in England and Wales, this paper examines the changing face of investigations in relation to escalating digital demand.

The analysis presents the national and regional organisational parameters of deploying digital expertise in criminal investigation and examines some of the challenges of being a digital media investigator (DMI). Through testimonies from DMIs, digital forensic practitioners, investigating and senior officers and forensic managers, the analysis explores the organisational tensions in the collection, processing, interpretation and use of information from digital devices for evidential purposes.

The paper offers an empirical basis for the comparative study of how the DMI role has been implemented by law enforcement agencies and its fit within broader institutional considerations and processes.

The development of the DMI role has raised questions about the supply of digital expertise, especially to volume crime investigations, and tensions around occupational divisions between scientific and operational units.

The findings show that while the introduction of the DMI role was much needed, the development of this valuable provision within each force and the resources available require sustained and coordinated support to protect these professionals and retain their skills.

This study contributes to the growing sociological and criminological literature with an ethnographically based perspective into the organisational and occupational tensions in the identification and processing of digital evidence in England and Wales.

Building on the findings of a British Academy-funded project on the development of digital forensics (DF) in England and Wales, the purpose of this paper is to explore how triage, a process that helps prioritise digital devices for in-depth forensic analysis, is experienced by DF examiners and police officers in four English police forces. It is argued that while as a strategy triage can address the increasing demand in the examination of digital exhibits, careful consideration needs to be paid to the ways in which its set-up, undertaking and outcomes impact on the ability of law enforcement agencies to solve cases.

The methodological approach adopted here builds on the ethnographic turn in criminology. The analysis draws on 120 h of ethnographic observations and 43 semi-structured interviews. Observational data of the working DF environment at each location and a systematic evaluation of internal documents, organisational settings and police priorities helped refine emergent analysis threads, which were analytically compared between sites and against the testimonies of members of different occupational groups to identify similarities and differences between accounts.

The findings emphasise the challenges in the triage of digital exhibits as they are encountered in everyday practice. The discussion focusses on the tensions between the delivery of timely and accurate investigation results and current gaps in the infrastructural arrangements. It also emphasises the need to provide police officers with a baseline understanding of the role of DF and the importance of clearly defined strategies in the examination of digital devices.

This paper aims to bridge policy and practice through an analysis of the ways in which DF practitioners and police officers in four English constabularies reflect on the uses of triage in DF to address backlogs and investigative demands. Highlighting the importance of digital awareness beyond the technical remit of DF units, it offers new insights into the ways in which police forces seek to improve the evidential trail with limited resources.

This chapter reviews traditional intelligence work, primarily how intelligence was perceived and conducted in the industrial economy. The review includes economic sectors with dedicated intelligence functions such as military, law enforcement, and national security. The review also includes secondary intelligence work in all other economic sectors. Looking across all these examples, the authors present a traditional life cycle model of intelligence work and highlight this traditional view of intelligence’s tactical and reactive approach. The chapter details the historical evolution and common intelligence elements in military, business, law enforcement, judicial forensics, national security, market, financial, medical, digital, and computer forensics.