Automated planning to prioritise digital forensics investigation cases containing indecent images of children

Law enforcement agencies (LEAs) globally are facing high demand to view, process, and analyse digital evidence. Arrests for Indecent Images of Children (IIOC) have risen by a factor of 25 over the previous decade. A case typically requires the use of computing resources for between 2-4 weeks. The lengthy time is due to the sequential ordering of acquiring a forensically sound copy of all data, systematically extracting all images, before finally analysing each to automatically identify instances of known IIOC images (second-generation) or manually identifying new images (first-generation). It is therefore normal practice that an understanding of the image content is only obtained right at the end of the investigative process. A reduction in processing time would have a transformative impact, by enabling timely identification of victims, swift intervention with perpetrators to prevent re-offending, and reducing the traumatic psychological effects of any ongoing investigation for the accused and their families. In this paper, a new approach to the digital forensic processes containing suspected IIOC content is presented, whereby in-process metrics are used to prioritise case handling, ensuring cases with a high probability of containing IIOC content are prioritised. The use of automated planning (AP) enables a systematic approach to case priorisation. In this paper, a planning approach is presented where AP is used to generate investigative actions in 60-minute segments, before re-planning to account for discoveries made during the execution of planned actions. A case study is provided consisting of 5 benchmark cases, demonstrating on average a reduction of 36% in processing time and a 26% reduction in time required to discover IIOC content.