Cybercrime – Digitally Forensic Analysed Devices

Digital Forensics plays a major role in some police investigations.  There is an increasing amount of crime carried out either online or with the use of devices such as mobile phones. 

In response to a recent FOI published by Police Scotland, there are approximately 11,000 devices authorised for a digital forensic examination each calendar year.  The devices considered in the table below are: mobile telephones, SIM cards, Satellite Navigation Devices (Sat Navs) and tablets. 

Whilst the number of devices appears to plateau around the 11,000 per year, the volume of data available via the devices mentioned has increased somewhat as a lot of people have their ‘lives on their phone/tablet’.  The volume of devices authorised to be examined that were mobile telephones is provided in the table below.   

Police Scotland do not outsource digital forensic examinations.  All are carried out in-house.  The process of retrieving evidential data during the digital forensic examination process is led by the what the Investigating Officer/Senior Investigating Officer have detailed on the Examination Request Form.  The team can also be guided by the Crown Office and Procurator Fiscal Service (COPFS).

Types of data that can be extracted from mobile devices include: call logs, text messages (SMS, Whatsapp, Facebook Messenger etc); location data and images.  Data are not routinely collected for what has been extracted from a device.    

Information on any encryption challenges is not readily available.  Each device that had been examined.  This would be labour intensive due the volume of data that would need to be considered.  Whilst there may be some technological issues recorded, it is not information that Police Scotland would release as this could enable criminals understanding of the Force’s cyber analysis capabilities.  The disclosure of such information could potentially increase the risk of harm to the public and well as impacting the delivery of effective operational policing.