How can we help?

Triage

What is a digital forensic triage process & what is its role in a digital investigation?

When you are presented with mountains of information on numerous devices, how do you quickly and cost-effectively differentiate the important from the unimportant?

Digital forensic triage is the initial phase of a digital investigation, providing rapid assessment and prioritisation of digital evidence. The process will quickly identify and categorise potential evidence in order to determine the scope and direction of a digital investigation.

What tools are employed during the triage process?

During the triage process, we employ automated tools and techniques to quickly scan and analyse digital artifacts, such as file metadata, system logs, internet browsing history and other potentially relevant data. We will extract and preserve volatile data, such as running processes and network connections, to capture the current state of a system.

Further examples

Prioritising Forensic Evidence

Tools used in child exploitation and human trafficking cases

In cases of child exploitation and human trafficking, time is of the essence. Due to the urgency involved, investigators cannot afford to spend extensive hours on imaging and analysing evidence. To address this challenge, triage tools play a crucial role by providing investigators with a rapid assessment of the situation. This enables law enforcement officers to be deployed promptly in an effort to locate and rescue victims. While traditional forensic tools are still employed, they are often used subsequently to gather further evidence and build a comprehensive case against the perpetrators.

Tools used in criminal investigation cases

Digital devices belonging to victims and witnesses often hold critical evidence in criminal investigations. While it may be necessary to collect all data from devices belonging to alleged perpetrators, the same approach is not always suitable for victims and witnesses. In such cases, triage tools are employed to assist in being able to scan the devices of victims and witnesses, to identify anything of relevance. This process will minimise privacy concerns and ensures compliance with legal collection procedures.