Opportunity: Police Digital Service, DFP Selective Extraction and Examination Project

1. Situation

Data from victims’ and witnesses’ mobile devices provide vital digital forensic evidence in police investigations, however, current COTS digital forensic tools by design typically extract large quantities of data from a device, which often include case irrelevant information. From the perspective of victims and witnesses the extraction of case irrelevant personal information can feel highly intrusive and disproportionate, particularly when their device is taken away for prolonged periods.

The Police Digital Service Digital Forensics Programme (DFP) aims to support police forces in implementing selective extraction and examination tools that support the examination and extraction of case relevant information from devices, and minimise privacy intrusion and disruption for victims and witnesses of crime.

2. Problem

Applications on mobile devices (for example chat -based applications) present a particular challenge for selective extraction and examination. Many applications store relevant information in complex database structures that cannot be easily accessed (see example). Database schema also vary significantly between applications and even between different version of the same application.

Current COTS tools tackle this problem by either extracting the entire database(s) in a forensically sounds manner, which is then filtered according to certain parameters or capturing screenshots from the device of relevant information.

3. What does success look like

DFP are interested in novel approaches and the art of the possible for selectively extracting relevant information from data stored by applications in databases on mobile devices (e.g.  chat-based applications like WhatsApp and Facebook Messenger) on different Android and iOS devices, using pre-defined search criteria (including, but not limited to, time and ranges, targeted key words, geolocation), in a way that minimises privacy intrusion, is forensically sound and can be deployed on a portable device (e.g. phone, tablet or laptop), without the need to seize the device.

DFP are keen to understand the pros and cons of any proposed approaches, the applicability and sustainability of the approach to the diverse and rapidly changing mobile device applications market, and the feasibility of applying the approach to frontline digital forensic tools that can be automated and require minimal training. DFP are particularly interested in responses from key market players in digital forensic tools.

For any questions and to submit a proposal, please email: [email protected] | Submission deadline - COP 31 December 2022