Extracting intelligence

The potential implications of making digital forensics intelligible and quickly actionable are immense, whether that is to allow forces to meet the latest bail requirements, to secure early guilty pleas and reduce the number of officers having to attend court, or simply to eliminate the huge backlogs of devices waiting to be examined by hi-tech crime units across the country. Digital forensics to most people is an analysis conducted on a device or computer with the result returned to an investigator months later, either proving or failing to show that a suspect had committed a particular crime. But what if that analysis was available in the first 24 to 48 hours? And what if the results could be made available to investigators while the suspect was still in custody? And then if the information derived from examining digital data could automatically be checked against other intelligence held by an agency? The rapid growth of technology has had an undeniable impact on the way investigations are conducted. More than 90 per cent of cases now involve some form of digital evidence, ranging from text messages to images and videos, all of which can be analysed to provide vital information. However, as the volume and velocity of this data continues to increase, it is beginning to outpace capability. The traditional model of investigations featuring digital intelligence can lead to significant delays. After a device such as a phone is seized, it is passed to an examiner, who must comb through it for relevant information that analysts compile into a report. This process in itself often causes backlogs, but investigators must then try to identify useful details from a mountain of evidence. The end result is a lengthy and inefficient process that typically results in evidence that is only used to corroborate what officers already knew. Cellebrite is renowned globally for its capability to unlock and extract data from mobile phones. Since first moving into forensics in 2007, the company has rapidly grown to support law enforcement in almost all developed countries and all UK police forces. At its UK user event earlier this month, Police Professional met its senior executives and heard how in the past few years, as a result of what its customers have said at such events, the company’s focus has shifted onto the broader issue of digital intelligence. In the past few months, it has released two new products – the standalone Analytics Desktop and the organisation-wide Analytics Enterprise – that aim to help forces make digital data more accessible, intelligent and actionable. Rather than being used post-incident, as Cellebrite’s products usually have been, the Analytics series is designed to be used throughout an investigation. The technology automates time-intensive areas of digital forensics such as image and text analysis, ensuring investigators have fast access to the intelligence they need. It merges large quantities of data sources, allowing users to simultaneously map, visualise and manage the information to identify patterns and uncover leads with greater speed and accuracy. It helps officers present evidence in a way that is easily understandable, and has the added benefit of allowing digital evidence to play a larger role in investigations, as accessing it earlier can provide the vital leads needed to crack a case. “This is what this concept of digital intelligence really gives an agency – the ability to have thorough access to evidence and collect it in a forensically sound way, implement a tiered structure to increase the sharing of that intelligence, and make it intelligible to non-technical end users,” explains Jeremy Nazarian, Cellebrite’s chief marketing officer. “To fill in the pieces of that puzzle with digital and make it actionable and accessible for them.” Without a solid lead in the first 48 hours of a case, the chances of a successful resolution can reduce by as much as 50 per cent. However, finding this information can be difficult given the scale of information that investigators can be