The aim of all digital investigations, whether they conclude in court or not, the results of the process must be admissible in a court of law. The process followed by investigators is crucial in ensuring admissibility of evidence. Consequently, in this activity learners are asked to consider flawed investigations.
Individuals are required to form a start-up organisation of no more than FIVE members and no less than FOUR members.
Each member of the start-up will act as resident expert for an aspect of the forensics process. Each team member should select and research one of the following aspects:
Data Provenance and Integrity. Accepted standards and procedures must be followed by investigators when acquiring evidence.
Scientific Methodology. The outcomes of an investigation should be reproducibility by a third-party to ensure validity.
Tool Validation. The tools used within a digital investigation need to be validated.
Forensic Procedure. The members of the court must have confidence in the outcomes of forensics process.
Triage. The volume of data can result in investigations being delayed and salient points being missed. Consequently, effective triaging must be performed to reduce the data being considered.
Each expert member should meet with the expert member from other start-ups and discuss the specific aspect they have researched. Each expert member should:
Share what they have discovered from their research. Expert members should share the salient and interesting aspects of what they have learned from their research on legal approaches for the country or region.
Articulate expert presentation for start-up. Expert members should share the presentation they are going to present to their start-up to get feedback and support from other expert members.
Support and provide feedback to other experts. Expert members should provide feedback and support to other experts in shaping their presentation to their start-up firms.
Experts should reflect on the feedback they received and what they have observed in their expert discussion session when refining their expert presentation. Experts should recall that their start-up firms are relying on their presentation of research into characteristics of the Forensics process.
Experts should return to their start-up firm and give their presentation. The leader of the firm should then determine the appropriate running order and ask each expert within the start-up firm to present their research. The leader of the start-up firm should encourage members to ask questions as well as ensure that presentations and questions for a particular aspect do not exceed 10 minutes.