A Triage Triangle Strategy for Law Enforcement to Reduce Digital Forensic Backlogs

The explosive growth of computer technologies creates many electronic data and produces much digital evidence of people's lives. As technology has improved, the volume of data for cybercrime investigation keeps growing at unprecedented rates and creating a quandary for Law Enforcement Agencies (LEAs). This study discusses the rise of digital evidence and the triage needs in digital forensic processing. It requires the sincere examination of all available data volumes at the scene or in the lab to present digital evidence in a court of law. In order to maintain the relevance, reliability, and sufficiency of digital evidence, investigators must establish a process model that can provide a quick response at the scene. This study proposes the novel triage triangle strategy of digital forensic components and illustrates TEAR phases from the viewpoint of THOR dimensions to describe the proper practices for identifying, collecting, acquiring, and preserving the digital data. It facilitates the efficiency and effectiveness of reducing digital forensic backlogs for LEAs.