Richard Andrews, Digital Forensics Manager for the South Wales Police, has been a police officer for 30 years, and involved in digital forensics for half of that time. As such, he’s had a front-row seat for viewing the massive changes that have taken place in local policing during the past few decades. While today’s officers benefit from much better communications and investigative solutions, the criminals have also taken advantage of communications and other technology solutions to improve the success rates of their activities – which means the bad guys can sometimes be just as well-equipped as the good guys.

To stay ahead of the criminals, Andrews and his digital forensics colleagues must constantly train and learn to keep their digital skills razor sharp as they investigate crimes such as drug-dealing or possession of indecent images of children. While Andrews has already made significant inroads in his plan to improve the South Wales Police force’s Digital Intelligence knowledge, many challenges remain for the digital forensics unit.

Digital Intelligence technology adds dimension and speed to South Wales investigations, while providing directional signposts so that investigators can accelerate the path to justice. (Digital Intelligence is the data collected and preserved from digital sources and data types – such as smartphones, computers, and the cloud – and the process by which agencies collect, review, analyze, manage, and obtain insights from this data to run their investigations more efficiently.)

Sharing the digital workload

Andrews’ team of examiners, along with about 12 digital media investigators, or DMIs, collectively examine about 13,000 devices a year. At this volume, clearly technology has to be put to work alongside forensic examiners and law enforcement officers.

The Digital Forensics & Cyber Crime Unit of South Wales Police use various Cellebrite solutions, such as UFED Touch2 and Cellebrite Physical Analyzer, to extract data from mobile devices, USB drives, and computers. (Credit: walesonline.co.uk)

To address this challenge, the force has created a tiered system for analyzing devices and has also deployed technology that offloads some of the burden of collecting and analyzing Digital Intelligence. For example, the DMIs assist the forensics examiners in conducting basic digital data collection. While the DMIs do not have the expert training of the forensic examiners, they are knowledgeable about using digital intelligence solutions to provide an initial account of the data that is on the phone. The DMIs might also be assigned phones associated with less-critical investigations, freeing up time for Andrews and his forensic examiners to work on more complex cases.

Puzzling out passwords

Digital Intelligence solutions played a key role in a recent case involving indecent images of children (IIOC). After recovering a suspect’s phone, investigators discovered that the Secure Folder feature had been activated on the device. The suspect told officers that he did not realize that Secure Folder had been activated, and that he could not remember the password.

Once forensic examiners discovered passwords for different applications and accounts, they could see a pattern: The first three letters related to the application itself, followed by a set combination of letters and numbers, such as FaC%OgTfD5G for Facebook.

“This knowledge gave us the ability to work out the password for the secured folder,” Andrews explains. On opening the folder, examiners discovered the IIOC images. The case had not yet come to court as of early summer 2021, but investigators expect the suspect to plead guilty to charges of possession and distribution of Indecent Images of Children, considering the wealth of evidence.

Keeping up with criminals

The South Wales force is ensuring that investigators stay on top of new digital evidence trends so officers can continue bringing criminal to justice. They must grapple with more and more encrypted devices, for example.

“We need constant upskilling and constant training in understanding encryption,” says Andrews. “How are we bypassing that encryption? How are we getting around that PIN?” By constantly developing their capability and knowledge, working closely with a myriad of partners, academia, and forensic solutions Andrew and his team are able to keep one step ahead.

To see how other agencies around the world are harnessing the power of digital technology to protect and save lives, accelerate justice, and preserve data privacy click here.

About the Author: Sean Millwaters is a Digital Intelligence expert with more than 13 years of combined military and police experience. In his previous profession, he was a member of various law enforcement squads involved with drugs, surveillance, and armed response.

Sean has more than 20 years of sales experience working with law enforcement, government, and military agencies. For the past seven years, he served as Sales Director/Senior Sales Director, VP Sales UKI, and VP Sales EMEA for Cellebrite.

For more information visit us at Cellebrite.com.