Digital forensics investigations: Analyzing the data behind complex criminal schemes

To get to the bottom of criminal schemes, from white collar crime to cyberattacks, investigators must rely on clues and connections hidden within data. Digital forensics is the process of gathering and making sense of digital evidence to uncover how a criminal scheme has unfolded.

In the case of simple criminal schemes carried out by a lone bad actor, the investigation process may be relatively straightforward. But more often, criminal cases involve sophisticated schemes perpetrated by organized networks of individuals, sometimes working internationally. In these cases, data may be scattered across countless devices and platforms, deliberately obfuscated or encrypted. In the face of such complexity, investigators can struggle to connect all the dots and discern the bigger picture from the heaps of fragmented data.

This is where advanced data analytics technologies can be a game changer for digital forensics. By leveraging advanced forensic data analysis techniques, investigators can gain efficiency - accelerating the analysis process while ensuring no stone is left unturned in even the most complex criminal schemes.

In this article, we look briefly at the digital forensics investigation process before diving into the challenges many investigators face in today's high-stakes cases - and how they can better leverage data analytics for faster, more efficient forensic investigations.

A digital forensics investigation is the process of identifying, acquiring, processing, analyzing and reporting on data from digital sources. The fundamental goal is to extract meaningful information and insights from electronic data, transforming that raw data into actionable intelligence. In many cases, the findings and reports resulting from digital forensics investigations are used as key evidence in legal proceedings. 

Digital forensics has applications across a wide range of crimes and unlawful activities. Some of the most common areas are cyberattacks, hacking incidents, security breaches, and white collar financial crimes like fraud, embezzlement or money laundering. Some digital forensics investigations involve deciphering sophisticated organized crime rings, as international criminal enterprises are frequently the culprits behind large-scale cybercrimes and fraud schemes.

Digital forensics investigations aren't only about building criminal cases. They also play an important role in incident response and post-attack analysis for organizations. Understanding precisely how an attack or crime occurred is an essential step in mitigating risk, shoring up defenses, and preventing repeat incidents. Forensic data analysis provides this critical visibility.

Digital forensics investigations typically have 5 stages.

1. Identification of resources and devices: The first stage involves identifying and locating all potentially relevant data sources and devices. This could include computers, mobile devices, servers, cloud storage, transaction data, and more. 
2. Data preservation: Once the devices and data sources are identified, the next critical step is preserving the data in its original state to maintain evidence integrity. This often involves creating forensically sound images or backups of the original data sources to allow analysis without risking any modification of the original evidence.
3. Analysis: With the data preserved, investigators can then analyze the evidence, looking for key pieces of information, suspicious activity trails, correlations between events or people, and any other insights that could help unravel the criminal scheme. This analysis stage applies a wide range of digital forensics techniques and tools.
4. Documentation: All analysis activities must be carefully documented, including the tools and techniques used, the findings uncovered, and the preservation of any new evidence or data that results from the analysis.
5. Presentation of findings: The final stage involves compiling all findings, documentation, and relevant evidence into a comprehensive report that can be used for legal proceedings, disciplinary actions, organizational improvements, or any other required purposes.

The analytics phase of digital forensic investigations often presents the highest degree of complexity. This is the stage when investigators must put all the pieces together and uncover the true mechanics of how a criminal scheme unfolded. Several key challenges make forensic data analytics particularly daunting:

Networks of criminals are constantly devising novel, multi-layered schemes to try to cover their tracks. Sophisticated criminal cases may involve many layers, entities, geographies, etc. 

Take the example of white collar crimes or sophisticated fraud schemes. These may involve a dizzying array of accounts and transactions across multiple countries, the use of shell companies, synthetic identities, and more. Untangling the complex web of activity is like following a trail of breadcrumbs - investigators must make sense of a staggering amount of complex data to reconstruct what truly transpired.

Global digital transformation and advances in technology have resulted in an explosion of data. Transactions, communications, audit logs, and more are all proliferating rapidly. This translates to bigger haystacks of data for investigators to examine for needles of evidence, often under compressed time constraints.

Data relevant to investigations present in multiple formats. A single case may involve structured transactional data, as well as unstructured communications data like emails and chats, audio, video, and more. 

For complex schemes, investigators must find a way to piece together these heterogeneous data formats - de-siloing them to perform the kind of in-depth analysis required to get to the bottom of a criminal scheme without missing out on any important details.

An ever-increasing number of investigations have a digital forensics component. Electronic data trails often tell an important part of the story. At the same time, investigators face a perfect storm of challenges like the ones mentioned above.

Gaining efficiency in the data analytics phase of digital forensics investigations has become absolutely critical in this context. Traditional tools and linear methods are no longer sufficient. Investigators need ways to accelerate their analysis process, quickly surface insights from massive, disparate data sets, and connect the dots faster. Leveraging intuitive, powerful analytics technology that can tame complexity and amplify human insight is a vital part of the solution.

Forensic data analytics should rely on several different types of technology working in tandem to extract insights from within the data. Components of a forensic analytics stack may include machine learning models, text analytics, and graph visualization and analytics, all working together to make sure no suspicious patterns of behavior slip through the cracks.

Graph analytics is a particularly powerful asset in tracking down patterns and connections of interest within even the most complex datasets. A graph data structure includes not only individual data points, but also the relationships between them. It quickly analyzes which entities are connected to one another, and how.

In an investigative context, it’s a powerful tool to explore the networks around fraudsters, cybercriminals, and other wrongdoers. In a financial crime investigation, for instance, you can query your data to quickly understand which accounts money is flowing to and from, in what quantities, within which timeframe, etc. 

Going further, you can also analyze the indirect relationships in your connected data, making it easier to track down a full criminal scheme or network. Adding a graph visualization layer makes it easy to understand these complex connections quickly and intuitively. 

Graph analytics easily combines with predictive tools based on AI and machine learning. It can also combine with tools like NLP to make unstructured data available for analysis alongside sources of structured data. And graph offers scalability to accommodate increasing amounts of data or additional data sources.

Global organizations are using graph visualization and analytics tools to stay one step ahead of criminals. Deloitte Switzerland applies graph technology from Linkurious to forensic data analytics for faster, more efficient investigations.