Is the chain unbroken : a pilot study of the local police use of IT forensic processes

Sammanfattning: This work is done in cooperation with the Halmstad local police. We examine how seizedphones are handled throughout the organisation. We investigate where and if there canoccur issues with the physical device handling and we also look at how the extractions madeon seized phones are analysed and the possible problems with that work.We have interviewed several employees, both sworn and unsworn staff, we have looked atprovided statistics and done thorough background research in this field. The comparison andanalysis of the material show that the evidence integrity and the chain of custody standcomparably firm. We do on the other hand see issues with the knowledge level in the ITforensic field, the wish for more training, the lack of knowledge sharing between groups andthe risk for missing crucial evidence due to these issues. We also look at some possibleways of meeting the risks mentioned by investigating the newly employed IT caseadministrators and how that has turned out. At the local police stations, these persons solveissues that needed addressing but were previously neglected due to lack of knowledgeablestaff. The suggestions on adding these types of employees address some of the issues withextraction analysis. The paper also proposes some possible solutions to some of theproblems mentioned.