TV has made digital forensics seem like it’s a piece of cake—all you have to do is lean toward a blurry security camera frame, say “Enhance,” and it will work. Every time. (At least on CSI.)

In honor of the week, here are a few things television has taught the public about digital forensics, along with what actually happens in the real world.

“Enhance.”
On TV, three keystrokes turn 40 pixels of smudge into a readable license plate. And then the computer instantly gives up the name, age, address, and next of kin for who it’s licensed to. In real life, you can’t recover detail the camera never captured. Enhance a smudge and you get a bigger smudge. (A very well-documented bigger smudge, but still.)The 30-second hack.
Hoodie, dark room, green text scrolling, “I’m in. The perp is on Hollywood & Vine and has a small thermonuclear warhead in his backpack. Get on it, STAT!” In real life, a forensic image of a phone can take hours, it has to be in the examiner’s hands, and reviewing what comes out of it can take days. The green text is optional.Deleted means gone.
The TV villain deletes a file and pours a drink. Not on the keyboard. Deleting a file is more like taking the name off a mailbox. The house is still standing until somebody new moves in, and there may be copies in the cloud, on a backup, or on the phone of the person who received it.

Results before the commercial break.
Real forensic work runs on chain of custody, hash values, validated tools, and documentation that would put a prime-time audience to sleep. That’s the point. It’s what holds up when the other side’s expert goes through it line by line. The documentation, not the TV script.

The expert always works for the good guys.
On TV, the real expert works for the good guys and the bad guy’s expert is always overconfident In real life, the evidence doesn’t know who hired you, and the examiner shouldn’t care. The data is the data, and it shows what it shows.My favorite TV forensic tech.
Numb3rs, Season 2, Episode 8, “In Plain Sight.” Amita Ramanujan opens the top casing plate of the hard drive (exposing the magnetic platters to open air – this is such a no-no!) and proceeds to wave a handheld magnetic sensor wand over the open spinning disks while Charlie watches the data flow onto the display screen. Oh, how I wish!Forensic science is slower and less photogenic than television. It’s also more interesting, because it’s real. Really.

#ForensicScienceWeek #DigitalForensics #eDiscovery #ExpertWitness