skip navigation


Register for Latest Research

Stay Informed
Register with NCJRS to receive NCJRS's biweekly e-newsletter JUSTINFO and additional periodic emails from NCJRS and the NCJRS federal sponsors that highlight the latest research published or sponsored by the Office of Justice Programs.

NCJRS Abstract

The document referenced below is part of the NCJRS Virtual Library collection. To conduct further searches of the collection, visit the Virtual Library. See the Obtain Documents page for direction on how to access resources online, via mail, through interlibrary loans, or in a local library.


NCJ Number: 229278 Find in a Library
Title: Investigation Delayed is Justice Denied: Proposals for Expediting Forensic Examinations of Digital Evidence
Journal: Journal of Forensic Sciences  Volume:54  Issue:6  Dated:November 2009  Pages:1353-1364
Author(s): Eoghan Casey, M.A.; Monique Ferraro, J.D., M.S.; Lam Nguyen, M.Inf.Tech.
Date Published: November 2009
Page Count: 12
Type: Instructional Material
Format: Article
Language: English
Country: United States of America
Annotation: This paper describes a three-level approach to forensic examinations that will enable digital forensics laboratories (DFLs) to produce useful results in a timely manner at various phases of an investigation, thus reducing the unnecessary expenditure of resources on less serious matters.
Abstract: The first phase of the forensic examination of digital evidence is the survey/triage forensic inspection. This involves a targeted review of all available media in order to determine which items contain the most useful evidence and require additional processing. The second level of the examination is the preliminary forensic examination. This involves a forensic examination of items identified during survey/triage as containing the most useful evidence, with the goal of quickly providing investigators with information that will aid them in conducting interviews and developing leads. The third level of the examination involves an indepth forensic examination. This consists of a comprehensive forensic examination of items that require more extensive investigation in order to gain a more complete understanding of the offense and address specific questions. These three levels of forensic examination extend existing process models for conducting digital investigations that promote the forensic duplication and indepth forensic examination of all media. In addition, this tiered strategy takes into account the Computer Forensics Field Triage Process Model for conducting triage forensic inspection in the field when investigators require immediate results. Each level of examination in the proposed procedure can be performed either in the field or in the laboratory, with DFLs making this decision based on the specific case and available resources. This tiered strategy for conducting forensic examinations is based on the fact that certain cases require significant time and resources; whereas, other cases can be expedited, saving valuable resources. 6 figures and 24 references
Main Term(s): Criminology
Index Term(s): Computer evidence; Computer related crime; Cost effectiveness analysis; Efficiency; Forensic science training; Forensic sciences; Investigative techniques
To cite this abstract, use the following link:

*A link to the full-text document is provided whenever possible. For documents not available online, a link to the publisher's website is provided. Tell us how you use the NCJRS Library and Abstracts Database - send us your feedback.