Digital forensics - backlogs and timeframes
Notifications OFF
I've now completed my FOI requests, regarding the time it takes for police to do digital forensic examinations.
I asked two questions. One was the number of devices waiting to be examined and the other was how long, on average, do examinations take.
Most police forces could answer the first question, but only around half of them could give a timeframe. I have published the details below. The first figure is the number of devices in the backlog. The second is the average number of days taken to process a device.
This is only a snapshot, but it should give some indication of which areas can expect to experience the longest delays. On it's own though, it does not explain why many investigations take 2 years or more to come to court. There are clearly other factors that delay the investigation as well and I cannot say what those are.
Avon - 857 devices, 161 days
Bedfordshire - 329, 60 days
Cambs - 492, 110 days
Cheshire - 533, n/a
Cleveland - 785, 116
Cumbria - 624, n/a
Derbyshire - 317, 30 days (if high priority)
Dorset, Devon & Cornwall - 256, 86 days
Durham - 118, n/a
Dyfed Powys - 112, n/a
Essex - 617, n/a
Gloucestershire - 224, 14.5
Gwent - 186, n/a
Hampshire - 500, n/a
Hertfordshire - 230, 28
Humberside - 629, n/a
Kent - 1110, 229
Lancashire - 598, 65
Leicstershire - 339, 160
Lincolnshire - n/a, n/a
Gtr Manchester - 1306, n/a
Merseyside - 1225, n/a
Met (London) - 810, 267
Norfolk - 411, 68
North Wales - 753, 104
Northants - n/a, n/a
Northumbria - 825, n/a
North Yorks - 238, 90
Nottinghamshire - 316, n/a
PSNI - 1058, n/a
Scotland - 4394, n/a
South Wales - 589, n/a
South Yorks - 319, 210
Staffordshire - 412, 113
Suffolk - 411, 68
Surrey - 355, 49
Sussex - 465, 103
Thames Valley - 1359, n/a
Warwickshire - 527,n/a
West Mercia - 435, n/a
West Midlands - 337, n/a
West Yorkshire - 1339, 90
Wiltshire - 197, 69
I asked two questions. One was the number of devices waiting to be examined and the other was how long, on average, do examinations take.
Most police forces could answer the first question, but only around half of them could give a timeframe. I have published the details below. The first figure is the number of devices in the backlog. The second is the average number of days taken to process a device.
This is only a snapshot, but it should give some indication of which areas can expect to experience the longest delays. On it's own though, it does not explain why many investigations take 2 years or more to come to court. There are clearly other factors that delay the investigation as well and I cannot say what those are.
Avon - 857 devices, 161 days
Bedfordshire - 329, 60 days
Cambs - 492, 110 days
Cheshire - 533, n/a
Cleveland - 785, 116
Cumbria - 624, n/a
Derbyshire - 317, 30 days (if high priority)
Dorset, Devon & Cornwall - 256, 86 days
Durham - 118, n/a
Dyfed Powys - 112, n/a
Essex - 617, n/a
Gloucestershire - 224, 14.5
Gwent - 186, n/a
Hampshire - 500, n/a
Hertfordshire - 230, 28
Humberside - 629, n/a
Kent - 1110, 229
Lancashire - 598, 65
Leicstershire - 339, 160
Lincolnshire - n/a, n/a
Gtr Manchester - 1306, n/a
Merseyside - 1225, n/a
Met (London) - 810, 267
Norfolk - 411, 68
North Wales - 753, 104
Northants - n/a, n/a
Northumbria - 825, n/a
North Yorks - 238, 90
Nottinghamshire - 316, n/a
PSNI - 1058, n/a
Scotland - 4394, n/a
South Wales - 589, n/a
South Yorks - 319, 210
Staffordshire - 412, 113
Suffolk - 411, 68
Surrey - 355, 49
Sussex - 465, 103
Thames Valley - 1359, n/a
Warwickshire - 527,n/a
West Mercia - 435, n/a
West Midlands - 337, n/a
West Yorkshire - 1339, 90
Wiltshire - 197, 69
This is an interesting read! Such a range of time frames.
Interesting that there is so much variation - I suppose there could be many reasons why. A person under investigation could have many devices, devices might be taken from other people living at the same address or from the workplace, there might be more people under investigation in one area than another, maybe because of a larger population or maybe a particular police force focuses more on digital crimes. Or maybe some police forces just have less facilities or people for examining devices.
The Scotland backlog is quite alarming - what's going on there?
The Scotland backlog is quite alarming - what's going on there?
It would be interesting to adjust these for the populations in question, to give an idea of how overloaded individual forces are (I'm tempted, but not sure I'd persevere with it!). I understand the number of people coming to police attention is just going up and up, so it can only get worse.
Our police force is 4 years according to the FOI, however we were told at interview it would be 3-6 months before devices would be looked at.
The OIC seem to have no idea about time lines to relay back to families and give totally unrealistic much lower timings that can't be stuck to - which for us have ended up in even more severe amounts of distress.
The OIC seem to have no idea about time lines to relay back to families and give totally unrealistic much lower timings that can't be stuck to - which for us have ended up in even more severe amounts of distress.
Post deleted by user
That really depends how the particular force operates. Some of them have the capability to triage devices, which means they can do a quick scan on the day of the arrest to see if there is anything dodgy, before sending it away for a full examination.
But not all police forces have this ability.
But not all police forces have this ability.
Post deleted by user
My experience w. Yorkshire, was devices took approx 9months to be scanned. Working on final forensics lreport, could be longer to actually get anything returned to us.
I've no doubt they could do a 24 hour turnaround on a device, if it were considered an urgent priority. Although that would depend on the device not being encrypted and not having too much data on it.
The technology exists to do a quick scan for images and keywords in a chat for example. But if something is found then a full examination is usually required and that's when most devices go into the backlog.
The technology exists to do a quick scan for images and keywords in a chat for example. But if something is found then a full examination is usually required and that's when most devices go into the backlog.