Real case about how to turn a 4-month investigation into a 3-week one?

How do you deal with a hoarder? With a property so full of clutter that it’s difficult to see the floor. Difficult to deal with in any scene but the situation is compounded when you are dealing with a murder scene.

A UK based Digital Media Investigator (DMI) was faced with exactly that. The scene was completely full and upon initial investigation the number of digital devices were discovered. Not unusual however, the devices kept coming, in all a total of over 6000 items of a digital nature were found. Multiple computers, over 50 hard drives, external USB drives, cameras, digital recorders and loose media meant this was never going to be a simple task.

The DMI turned to Cyacomb Examiner to establish if any of the media contained data of an illegal nature. A fast, thorough scan of the occupant’s laptop revealed the presence of Child Sexual Abuse Material (CSAM). As the occupant of the property was the victim could this have been a motive for the offence?

At this point it was clear that all of the media would need to be examined to establish the extent of the offending, identify any potential victims of the offending and any motive for the murder.

Had all the exhibits been submitted to the local Digital Forensics Unit (DFU) for examination it is estimated that if 2 members of the team were seconded to that specific task it would have taken a total of 4 months to ingest, process, identify and grade the CSAM discovered. A financial cost in the region of £20,000 and with an additional knock-on effect to the DFU’s backlog created as a result of having two of the team working solely on this case.

Once again, the investigating team turned to Cyacomb Examiner, its ability to thoroughly search multiple devices (of differing types) simultaneously meant within 3 weeks all the devices had been scanned, assessed, discounted from the investigation where appropriate or processed for evidence. Grading the material found during the scan was also hugely beneficial as the investigating team knew almost immediately the extent and seriousness of the offending and the potential impact this may have on the case.

Utilising Cyacomb’s award winning triage capabilities as a first look tool the DMI Team were able to detect first evidence rapidly which meant informed decisions could be made impacting on the investigation plan.

By deploying Cyacomb Examiner as a screening tool no time was wasted, and only pertinent devices were escalated for further examination. Forensic examiners were able to focus solely on the devices most likely to contain evidence.

Finally, by combining Cyacomb Examiner with trusted data sources investigators were able to rapidly triage over 6000 digital exhibits with confidence, manage risk and make timely, informed decisions that ultimately led to a successful arrest and conviction.

These investigations are never about the money but, by employing a different approach, by thinking out of the box, by embracing a new gold standard in digital triage saving of over 81% were made in this case alone.

If you'd like to see how Cyacomb Examiner Plus can help you in your investigations, contact us or sign up for a free tailored trial today.