We were recently called to assist a local law enforcement agency with recovering a video that had been deleted from a DVR system. Officers had originally viewed the video of an assault that took place, but by the time they went back to retrieve the video it was not longer available to be viewed/exported in the DVR program. The Crown Attorney stated that the video was an important piece of evidence for the case and that "options" should considered for it's recovery. That's when we got the call.
I knew that this LE agency had a tech crimes unit and I asked the investigating officer why they were not dealing with this matter, to which he replied "They are so far behind with their cases and I know that it will take them months and months to get to this."
We did some on-scene preliminary analysis on the system and determined that there were some videos viewable but the date they were looking for was no longer stored in the DVR program. We did notice though that the system had a very large hard drive and that there may be an opportunity to recover deleted content, however it would take a day or so for us to do the work. The officer then told me that neither his agency, or the Crown's office wanted to pay for the recovery and that they would just go without this evidence and "hope for the best".
Lack of Resources ≠ Lack of Evidence
I recently read an article in the Toronto Star where RCMP Chief Supt. Jeff Adam stated that "police filing cabinets contain growing evidence that digital investigative limitations pose a risk to public safety" and he believes “that the (public’s) expectations and our ability to deliver on those are far apart and getting farther away every day. Canadians should ask themselves whether or not they’re satisfied that we cannot get evidence … Is that where they want the state of affairs to be, where we cannot enforce the law?”
While the quote above refers to the use of encryption on devices, it does raise questions about the amount of resources (time, people, monetary) that policing agencies are willing/able to commit to investigations involving digital devices.
Canadians should ask themselves whether or not they're satisfied with the fact that a lack of policing resources may result in not getting valuable evidence and therefore not being able to enforce the law.
I worked for many years in a Law Enforcement Technological Crimes Unit and I completely understand the challenges they face on a day to day basis. The increased amount of devices being used for committing crimes, the increased storage capacity of devices and the increasing amount of time needed for investigations all strain policing resources and in the end contribute to digital forensic case backlogs. There are many potential solutions to this issue; from software companies streamlining and automating digital forensic investigations to forming public/private partnerships. There are also many benefits to forming public/private partnerships; from reducing digital forensic case backlogs to crime reduction.