Transforming Forensics Digital: What works in digital forensics? (Effectiveness of digital forensics techniques)

The Transforming Forensics Digital project commissioned this Rapid Evidence Assessment (REA) to answer the following research question: What works in digital forensics? (Effectiveness of digital forensics techniques) The review of the evidence serves multiple goals. First, it explores what are the existing digital forensic techniques in use by practitioners? It was carried out rapidly in order to provide the Digital project and the wider Transforming Forensics programme with the necessary information about the effectiveness of digital forensics techniques that are in use by practitioners. Second, it provides a taxonomy of digital forensics techniques. Third, it identifies research challenges, gaps, and opportunities to assist the ongoing the Digital project to understand where the future investment may be most effectively targeted to improve digital service provision. This review thus generates valuable methodological lessons for similar exercises going forward. The review examines academic articles and evaluation published in English between 2014 and 2019. It adopts a systematic approach to the literature search and quality assessment to maximise transparency, replicability and the potential to update.