Always on, Always Connected: How Automating Forensic Workflows Can Improve Processing and Evidential Integrity

By Simon Whitburn, GM and SVP of International Business, Exterro

Introduction

Digital forensics has come a long way, but despite a great many discussions around automating key processes over the past decade, it remains a largely manual process that requires data to be extracted or supplied to numerous third-party systems. This burdens digital forensic teams and investigators with repetitive tasks and as the data mountain grows and the variety of devices and formats multiply, so too do data backlogs and processing queues. It’s a situation further exacerbated by a growing shortage of skilled DFIR and DF investigators and unless we begin to address the problem, it will almost certainly threaten the integrity of the process. 

Thankfully, rapid advances have been made in automating digital forensic processes in recent years, largely because of a focus on systems integration. Unlike Robotic Process Automation (RPA), which layers automation over the top of the process and contains no checks and balances, using an Application Processing Interface (API)-based architecture has allowed organizations to integrate their digital forensics platforms with other systems to create a comprehensive joined-up process. 

In this paper, we’ll explore the challenges businesses, legal teams, and law enforcement are facing concerning digital forensic processes, advances in automation, and how connecting systems with the digital forensics platform can boost productivity, ensure defensibility, and aid compliance.

Combining detection and DFIR 

In a corporate context, digital forensics usually requires the collection and extraction of data from intrusion detection and....