Forensic Science International: Digital Investigation 37 (2021) 301167

Contents lists available at ScienceDirect

Forensic Science International: Digital Investigation

journal homepage: www.elsevier.com/locate/fsidi

Exploring digital evidence recognition among front-line law

enforcement officers at fatal crash scenes
Thomas Holt a, *, Diana S. Dolliver b
a
Criminal Justice Department, Michigan State University, USA
b
The Department of Criminology and Criminal Justice, The University of Alabama, USA

a r t i c l e i n f o a b s t r a c t

Article history: Digital forensic evidence has become an essential component of criminal investigations across the United
Received 9 July 2020 States. The amplified integration of technology with society, however, continues to present new chal-
Received in revised form lenges for law enforcement officers. This issue is evident in one of the key responsibilities of police
29 March 2021
agencies involves the enforcement of traffic laws and regulations on surface streets and highways. It is
Accepted 23 April 2021
Available online 7 May 2021
unclear how well first responders recognize the need to seize digital evidence associated with fatal
vehicles accidents in the field. This study addressed this gap in the literature by examining a comparative
population of respondents from the state police agencies in a large Midwestern and large Southern state.
Keywords:
Crime scene
Using a vignette design, the findings demonstrated that respondents recognized the need to recover
Digital evidence mobile devices and telematics from the vehicles involved in fatal crashes. A substantive number of of-
Law enforcement ficers remained unsure of the potential digital evidentiary value of other objects on-scene (e.g., fast food,
State police makeup). Further, regional differences were observed in respondents’ responses. The implications for our
Technology understanding of police capacity and training needs were explored in detail.
© 2021 Elsevier Ltd. All rights reserved.

1. Introduction (National Highway Transportation Safety Board, 2019; Rivers,

One of the key public order roles of police agencies involves the
enforcement of traffic laws and regulations on surface streets and
highways (DeAngelo and Hansen, 2014; Van Kirk, 2000; Walker
and Katz, 2012). Police are often called in the event of traffic acci-
dents, such as vehicle collisions, to assist injured parties, determine
if laws were broken, and help keep order at the scene. This role is
particularly vital in the event of serious injuries to drivers or pas-
sengers, or fatalities that may have resulted from any collision or
crash (DeAngelo and Hansen, 2014; Walker and Katz, 2012). Offi-
cers collect information from drivers, passengers, and witnesses at
the scene to help reconstruct the events leading up to the accident
(Rivers, 2011; Van Kirk, 2000). The investigation can also determine
what laws were violated, as well as who may be charged for what
offenses (Rivers, 2011; Van Kirk, 2000).
Thousands of fatal crashes occur in the US ever year, stemming
from a range of factors including the failure of critical vehicle parts
to inclement weather affecting driving conditions to driver error
* Corresponding author.
E-mail addresses: holtt@msu.edu (T. Holt), DLDolliver@protonmail.com
(D.S. Dolliver).
2011). In recent years, there has been concern raised about the
potential for accidents stemming from drivers who are distracted
by their digital devices, including cell phones, MP3 players, and GPS
technology (Chan and Singhal, 2015; Overton et al., 2015; Wilson
and Stimpson, 2010). Research from the National Highway Traffic
Safety Administration estimates that approximately two percent of
the driving population in the US engages in hand-held manipula-
tion of mobile devices while driving at any time (National Center
for Statistics and Analysis, 2019). Additionally, the rate of manip-
ulation of devices has increased across all age groups since 2006,
particularly among those aged 16 to 24 (National Center for
Statistics and Analysis, 2019). Due to the risks posed by distracted
driving, 47 states and the District of Columbia have banned text
messaging for drivers backed by traffic citations that can be issued
by officers (National Center for Statistics and Analysis, 2019).
The rise of so-called connected or autonomous vehicles have
also introduced potential for accidents, as these vehicles can be
guided by microchips and electronics without the need for constant
driver attention (Dimitrakopoulos, 2011; Gerla et al., 2014;
Kennedy et al., 2019). Auto manufacturers such as Tesla argue that
drivers should be aware of their surroundings and able to take
control of the vehicle at all times, though evidence suggests that is

https://doi.org/10.1016/j.fsidi.2021.301167
2666-2817/© 2021 Elsevier Ltd. All rights reserved.
T. Holt and D.S. Dolliver
not the case (Kennedy et al., 2019; Schmelzer, 2019). In fact, several
fatal crashes have occurred where an automated vehicle was in use
and the driver was distracted or otherwise unable to avoid the
accident (Kennedy et al., 2019; Schmelzer, 2019).
As technology increasingly affects both the operation and op-
erators of automobiles, it is essential that police be able to use the
information stored on these devices when investigating fatal
crashes (Kennedy et al., 2019; Rivers, 2011). Specifically, the mobile
devices available to the driver and passengers in vehicles are
essential to investigators, including the text messages, web search
histories, applications, photos, and GPS data, would be essential for
accident investigators (Casey, 2011; Goodison et al., 2015). The
devices and equipment used to transmit information can also serve
as sources of digital evidence, such as wireless routers and web
servers the devices may have interacted with, including any in-
vehicle wireless Internet hotspots (Kennedy et al., 2019; Maras,
2012). The onboard computer and infotainment systems within
vehicles also produce digital evidence that can be used to support
system failures and driver behaviors (Gerla et al., 2014).
The potential value of digital evidence in criminal justice prac-
tice has led police and policy organizations to create guidelines and
recommendations for best practices in the field to ensure it is
correctly seized and stored (IACP, 2019; NIJ, 2008). These materials
are targeted toward the investigation of traditional criminal of-
fenses, and research suggests line officers in police agencies are not
well prepared to identify or secure digital evidence in the field
(Dolliver et al., 2017; Goodison et al., 2015; Holt et al., 2010, 2015,
2019; Stambaugh et al., 2001). There is even less knowledge as to
how digital evidence should be used in the investigation of fatal
vehicle crashes, or how well first responders recognize the need to
seize digital evidence associated with vehicles in the field (Dolliver
et al., 2017; Holt et al., 2019).
This exploratory study addressed this gap in the literature
through an examination of a population of line troopers and agents
who respond to fatal accidents from two state police agencies.
Respondents were presented with a scenario requiring them to
identify what digital and physical evidence they would collect at
the scene of a fatal accident. The experiential and demographic
factors associated with the need to secure digital evidence were
examined, demonstrating that respondents with prior training and
digital evidence field experience were more likely to seize digital
evidence. The implications of this analysis for our understanding of
police practice and policy are explored in detail.
2. Digital evidence: the benefits and challenges in law
enforcement
In the United States, technology is an essential part of social life.
Most U.S. adults own cell phones (96%), smartphones (81%), com-
puters (75%), and e-readers (~50%) (Anderson, 2019). The varied use
of technology and its integration into our personal and professional
lives creates an environment where individuals are overtly doc-
umenting their everyday lives through social media platforms and
blogging (Anderson and Jiang, 2018; Dolliver, 2019; Holt and
Bossler, 2015). The devices and platforms used for communica-
tion also covertly and overtly track users’ movements in space and
time (Dolliver, 2019; Novak et al., 2018). The search terms, photos,
texts, and emails sent by individuals also create social artifacts that
indicate their behaviors and interests (Tene, 2008).
As a result, digital evidence has become an increasingly
important source of information in proactive and reactive policing
encounters. The term “digital evidence” is intentionally ambiguous
given the breadth of information investigators can glean from
anything that connects to an electronic network and/or stores
electronic information: computer, cellular phone, digital camera,
2
Forensic Science International: Digital Investigation 37 (2021) 301167
portable storage devices (i.e., compact disc, external hard drive,
flash drive), wearable technologies (e.g., smart watches), and smart
televisions (Goodison et al., 2015; Novak et al., 2018). These items
hold tangible evidence of criminal acts, such as documents, files,
and images that may implicate an individual in an act (Casey, 2011;
Dolliver et al., 2017; Tuner, 2019). Additionally, digital evidence
provides supply routes to information that perpetrators may have
tried to destroy via cache review and file recovery tools (Lupariello
et al., 2018; Tene, 2008). There is also a wealth of information
gathered from digital technologies citizens interact with every day,
such as automatic license plate readers, social media search tools,
cell site location data, GPS tracking, and surveillance cameras
located in public and private spaces (Ferguson, 2017; Tuner, 2019).
Digital evidence plays a particularly important role at the scenes
of fatal vehicle accidents, which are a key investigative re-
sponsibility for state police, namely highway patrol officers and
troopers (Rivers, 2011; Van Kirk, 2000). In 2018, approximately
36,750 individuals lost their lives in vehicle accidents in the United
States, at a rate of roughly 1.14 deaths per 100 million vehicle miles
traveled (National Highway Traffic Safety Administration, 2019). To
determine the cause of such accidents, responding officers must
take the totality of circumstances into account, including deter-
mining the extent of distractions occurring within the vehicle(s)
involved, weather and road conditions, and the vehicle's actions
leading up to the crash (Rivers, 2011; Van Kirk, 2000). However, it is
unclear how well troopers in the United States are able to correctly
identify and properly seize digital evidence from these types of
crime scenes.
Since approximately one-quarter of traffic accidents involve the
usage of cell phones by the driver to engage in (often illegal) ac-
tivities, such as “texting and driving” (Chan and Singhal, 2015;
Wilson and Stimpson, 2010), it is essential to forensically examine
the mobile devices of those involved in fatal vehicle accidents to
establish cause (Horsman and Conniss, 2015). Data from mobile
device connected to a vehicle may yield digital evidence in the form
of SMS and MMS messaging, call logs, email applications, Internet
browsing history, and social media application usage (e.g., Snap-
chat, Twitter, Instagram, Facebook). Active and passive interaction
with a mobile device while driving is indicative of boredom and
lapses in concentration, frequent causes of vehicle accidents
(Oulasvirta et al., 2012; Overton et al., 2015). As such, these data
may be used by investigators to compose a timeline of actions taken
by the driver leading up to the moment of the fatal crash.
Less apparent forms of digital forensic evidence pertinent to
crash investigations are the data stored on the vehicle's electronic
control units (ECUs). ECUs are embedded specialized computers
that control all of the electronic functions of a car; there are
approximately 70 ECUs and 5 to 7 separate in-vehicle networks per
automobile (Nilsson et al., 2018). ECUs of particular importance to
investigators are the vehicle's on-board infotainment and tele-
matics systems. Infotainment units are a combination of hardware
and software that provide in-car audio and video entertainment as
toggled by the vehicle's occupants (i.e., data that stays within the
vehicle), while telematics systems are the telecommunication and
information hub of the vehicle (Kennedy et al., 2019; Nilsson et al.,
2018). The telematics ECU is also essential as a source of informa-
tion as it connects the vehicle to external networks, such as cellular,
Bluetooth, and WiFi. At the same time, the telematics ECU connects
the vehicle to infrastructure (called V2I), such as interactions with
smart traffic lights, as well as vehicle-to-vehicle (V2V) communi-
cations, as observed in autonomous and self-parking vehicles
(Nilsson et al., 2018).
Data stored on both the telematics and infotainment ECUs are
relevant to crash investigations. For instance, they maintain vehicle
system information such as the VIN and serial numbers of vehicle
T. Holt and D.S. Dolliver
systems. They also capture vehicle events such as the speed of the
vehicle, airbag deployment, doors opening and closing, GPS
syncing, breaking, and peripheral device connections (Kennedy
et al., 2019; Nilsson et al., 2018). The information of any mobile
device connected or paired to the vehicle, whether via USB cable or
Bluetooth, is also captured, including device IDs, call logs, SMS
messages, and navigation data (e.g., track-logs, saved locations,
previous destinations, and routes). Additionally, V2V data may
yield spatialetemporal positioning of the crash vehicle in relation
to otherwise non-involved cars on the road, thus generating
“vehicle witnesses” (Fuentes et al., 2009; Kopylova et al., 2011).
Such electronic data can significantly supplement physical evi-
dence collected from the crime scene, as skid marks and debris may
go unnoticed, be misattributed, or otherwise contaminated by in-
vestigators and emergency responders on-scene (Boon, 2014).
The sheer quantity of digital evidence made available within
vehicles should be a boon to the officers who must investigate fatal
auto accident scenes, particularly in determinations of driver
distraction and vehicle system failures. There is, however, little
research considering the extent to which first responders are aware
of digital evidence as materials worthy of capture on the scene.
Limited criminal justice research suggests police officers and first
responders have mixed awareness of cybercrimes generally, and
technologies more broadly (Goodison et al., 2015; Holt et al., 2010,
2015; Stambaugh et al., 2001). In addition, larger jurisdictions tend
to have the necessary resources and manpower needed to staff
specialized digital evidence-related units (Holt et al., 2010; Willits
and Nowaki, 2016).
In the absence of specialized staff to seize digital evidence, the
responsibility falls to the first responder at the crime scene to
identify and minimally triage the devices that may support of an
investigation (Goodison et al., 2015; Hinduja, 2007; NIJ, 2008).
Recently, the International Association of Chiefs of Police (2019)
noted the lack of digital evidence training provided to police
academy recruits and emphasized the need for improved delivery
of content through continuing education for police staff. A range of
field guides have been produced (IACP 2019; NIJ, 2008), but little
research considers how often the average first responder applies
this knowledge in the field (except Lee et al., 2019). Should a police
officer fail to properly secure devices at the scene or mishandle
equipment, it may be possible to challenge the evidence later
produced at trial and complicate a prosecution (Dolliver et al., 2017;
Hinduja, 2007; Stambaugh et al., 2001).
The unique challenges posed by the nature of digital evidence
may complicate the process of identification, search, and seizure by
first responders in the field. Thus, this comparative study examined
the factors associated with digital evidence recognition at fatal
vehicle crash scenes through the application of a unique survey
instrument completed by respondents in two state police agencies.
3. Data and methods
Data for this study were collected through a survey instrument
distributed to all sworn officers and troopers within a large Mid-
western state police force and all sworn troopers and State Bureau
of Investigation (SBI) Special Agents in a large Southern state police
force. An email survey was distributed via internal mailing systems
to both police forces in February 2019. The initial email solicitation
included a description of the study, the ethical protections provided
to participants, and a link for the electronic survey instrument.
Participation was voluntary and no enticements were provided to
respondents. A follow-up request was distributed in March, 2019,
and data collection terminated in April, 2019.
A total of 345 individuals participated in the Midwestern state,
though there was some variation in complete responses. For
3
Forensic Science International: Digital Investigation 37 (2021) 301167
instance, 311 respondents indicated their rank or pay level, which
reflects a response rate of 17.7% of all active sworn forces (n ¼ 1751).
Additionally, 51.1% of all respondents served as troopers, which is in
keeping with the general distribution of troopers in the overall
force (n ¼ 1022; 58%). Respondents were predominantly male
(n ¼ 275; 88.4%), and white (n ¼ 280; 81.2%), with African Ameri-
cans (3.2%), Hispanic (1.3%), and other self-identified racial groups
represented (2.9%).
In the Southern state, a total of 168 individuals participated from
the two agencies responsible for responding to and investigating
fatal traffic accidents, which reflected a response rate of 25.3% of all
active sworn forces (n ¼ 664). Within the sample, 97.02% of re-
spondents were male and 82.74% were white, which is in keeping
with the general distribution in the overall force (96.3% and 81.1%,
respectively). In terms of rank, 48.21% explicitly identified their
rank/pay level as trooper or senior trooper (sr./troopers represent
77.8% of the total population in this study), 13.69% identified their
rank/pay level as Special Agent or Senior Special Agent (22.4% of the
total population in this study), and 38.69% identified their rank as
other with either organization (e.g., Captain, Corporal, Investi-
gator). In addition, 78.99% were assigned to a highway patrol/traffic
detail, meaning respondents were more likely to act as first re-
sponders to vehicular crash scenes. The average age of respondents
was 35e54 years old (measured as a categorical variable), which
closely matched the overall population average of troopers and
agents from the Southern state (42.5 years old).
The final sample consisted of 450 respondents due to listwise
deletion. There were 302 respondents from the Midwest (67.1%)
and 148 from the South (32.9%), which was proportionate to the
size of the respective state agencies in general. In fact, the force
strength of the Midwestern state police force was more than double
that of the Southern state. As a result, this convenient, yet purpo-
sive sample from both states appeared to reflect the larger popu-
lation of the state police forces generally. Thus, this population
appeared appropriate for use in this exploratory analysis.
3.1. Dependent variables
To assess officers’ ability to recognize digital evidence in the
field, survey respondents were presented with a vignette
describing a call for service that they may initially encounter on
duty. Scenarios are common in criminological and political science
research to assess individual actions in unique situations (Fishbein
and Ajzen, 1975; Higgins et al., 2005; Lupariello et al., 2018; Piquero
and Bouffard, 2007). Additionally, scenarios appear to be valid
mechanisms to assess actual behaviour in the real world (Fishbein
and Ajzen, 1975; Kim and Hunter, 1993; Lupariello et al., 2018).
To that end, a vignette was designed with input from both state
police agencies to present a situation to respondents reflecting real
experiences in the field. The following language was used:
You respond to the scene of a two-car traffic crash, which ap-
pears to have had one fatality, killing the driver of the second
vehicle. Witnesses indicated that the driver of the first vehicle was
driving erratically. Upon interacting with the driver of the first
vehicle, you note that they do not appear intoxicated. With the field
interview of driver one, what items, if any, will you collect for po-
tential evidentiary value? Please select all that you think apply.
After this description, respondents were presented with the
following question: “With the field interview of driver one, what
items, if any, will you collect for potential evidentiary value? Please
select all that you think apply.” Participants were presented with
four total response options: 1) mobile devices; 2) fast food that may
have been within reach of the driver; 3) makeup and/or hair
products that may have been within reach of the driver; 4) vehicle
infotainment or telematics information; and 5) other. The scenario
T. Holt and D.S. Dolliver Forensic Science International: Digital Investigation 37 (2021) 301167

was designed to elicit multiple responses from participants on the
basis of legal precedents, recommendations from professional or-
ganizations, and field experience. In addition, the statement what
has “potential evidentiary value” was deliberate so as to allow re-
spondents to identify any and all materials they felt would be
relevant. Thus, the selection of digital and physical materials was
allowed, so long as they felt it would support their investigation in
the scenario.
The responses to the scenario were used as dependent variables
in this analysis to identify any significant relationships between
respondents’ views and various occupational and demographic
measures as independent variables. Multiple tests of significance
were utilized (chi-square, t-tests, Spearman correlations), and any
significant relationships observed were highlighted using asterisks
to denote the level of significance.
3.2. Independent variables
Four measures were included to assess any potential relation-
ship between respondents’ occupational experiences and their
knowledge of digital evidence (see Table 1 for detail). These items
were included based on relationships identified in prior studies on
police perceptions of cybercrimes and crimes with digital eviden-
tiary components (e.g. Hinduja, 2004; Holt and Bossler, 2012;
Senjo, 2004). First, participants were asked to assess their comfort
level with computer use through a six-item Likert scale (1 ¼ very
uncomfortable; 2 ¼ uncomfortable; 3 ¼ somewhat uncomfortable;
4 ¼ somewhat comfortable; 5 ¼ comfortable; 6 ¼ very comfort-
able). Second, respondents were asked when was the last time they
responded to a crime scene where digital evidence was present
using a six item response (digital evidence scene: 1 ¼ never; 2 ¼ over
a year ago; 3 ¼ within the last year; 4 ¼ within the last several
months; 5 ¼ within the last few weeks; 6 ¼ within the last week).
Two additional binary variables were included: whether they
received training in the investigation of online crime, and if the
officer knew their digital evidence contact (0 ¼ no; 1 ¼ yes).
Additionally, seven variables were included as demographic
controls, including age (1 ¼ 18e24; 2 ¼ 25e34; 3 ¼ 35e44;
4 ¼ 45e54; 5 ¼ 55e64; 6 ¼ 65 and older), education (1 ¼ high
school; 2 ¼ some college; 3 ¼ college degree; 4 ¼ some graduate
school; 5 ¼ graduate degree), and years of policing experience
(1 ¼ less than one year; 2 ¼ 1e5 years; 3 ¼ 6e10 years; 4 ¼ 11e14
years; 5 ¼ 15e20 years; 6 ¼ 21e30 years; 7 ¼ 31 or more years).
These items were measured categorically to simplify the response
options for participants. The majority of respondents were between
45 and 54 years of age (n ¼ 149; 35.9%) and reported having 21e30
years of experience (n ¼ 126; 30.1%). Rank was included as a binary
measure that segmented respondents into troopers, officers, or
investigators (0) and sergeants (1). Race was included as a binary
measure (0 ¼ white; 1 ¼ minority group member) due to a majority
Table 1
Descriptive statistics of sample population.
of respondents (87.2%) identifying as white (see Table 1). State of
origin was included as a binary to reflect the Midwest (0) or South
(1). Lastly, gender was measured as a binary variable (0 ¼ male;
1 ¼ female).
4. Results
Respondents were asked to assess their comfort level with
computer use to assess what impact technology use may have on
digital evidence recognition (e.g. Holt and Bossler, 2012; Holt et al.,
2019). The majority of respondents reported being either
comfortable (n ¼ 146; 32.6%) or very comfortable (n ¼ 160; 35.7%)
using computers every day. A small proportion also noted they
were very uncomfortable using computers (n ¼ 52; 11.6%) in
keeping with prior research among line officers in police agencies
(Holt and Bossler, 2012; Holt et al., 2019). Those who received
training in digital forensics evidence recovery and response were
significantly more likely to be comfortable using a computer
(c2 ¼ 24.635***; t ¼ 4.779***).
A substantial proportion of respondents (n ¼ 185; 41.3%) also
received training in investigating online incidents and crimes. Those
with fewer years of experience were less likely to have received
training (c2 ¼ 13.416*,.t ¼ 2.277*), while those who were younger
(t ¼ 1.956*), from the Midwest (c2 ¼ 20.358***,.t ¼ 4.756***), and
had more education were significantly more likely to have received
training (c2 ¼ 11.382*,.t ¼ 3.225***). Additionally, most respondents
knew who to contact in the event they needed assistance regarding
digital evidence recovery while at the scene of a crime (n ¼ 357;
86.9%). Those who were younger (c2 ¼ 11.269*, t ¼ 2.778**), from
the Midwest (c2 ¼ 15.268***, t ¼ 3.601***), and were more
comfortable using a computer (x2 ¼ 11.970*; t ¼ 1.932*) were more
likely to know their digital evidence contact.
Respondents were also asked to assess the last time they
responded to a scene where digital evidence was present. A sub-
stantive proportion responded to such a scene within the last week
(n ¼ 104; 23.9%), or the last few weeks (n ¼ 79; 18.2%). A small
proportion responded to such a scene over a year ago (n ¼ 74; 17%),
or never responded to a scene with digital evidence in their career
(n ¼ 49; 11.3%). White respondents were more likely to have
responded to a scene in the last year (c2 ¼ 19.356**; t ¼ 2.885**),
as were those who received training (c2 ¼ 55.270***; t ¼ 8.220***),
were from the Midwest (c2 ¼ 50.436***, t ¼ 6.495***), knew
their digital evidence contact (c2 ¼ 44.154***; t ¼ 4.220***), and
were more comfortable using a computer (t ¼ 2.695**).
There were two primary responses among respondents to the
scenario question regarding what should be done at the scene of a
fatal accident: 1) collect mobile devices (86.9%) and 2) the tele-
matics of the vehicle (73.6%; see Table 2 for detail). This distribution
is sensible given the potential information that may be stored on
these devices to assist in the investigation and reconstruction of the
accident. A proportion of respondents also indicated they would
search for makeup (24.9%) and fast food (24.2%) around the drivers,
which indicates a lack of understanding in terms of what

Variable Mean Min Max

Table 2
Comfort Level (n ¼ 448) 4.64 1 6 Respondents’ decisions regarding what actions to take in the digital evidence sce-
Digital Evidence Scene (n ¼ 435) 3.85 1 6 nario (n ¼ 450).
Training (0 ¼ no, n ¼ 448) 50.8% Yes 0 1
Digital Evidence Contact (n ¼ 434) 82.2% Yes 0 1 Response Options Full Sample Midwestern Southern
Age (n ¼ 415) 2.70 1 6
Percent N Percent N Percent N
Education (n ¼ 421) 2.70 1 5
Years of Police Experience (n ¼ 418) 4.39 1 7 Mobile device 86.9 391 92.1 278 76.4 113
Rank (n ¼ 414) 70.6% Trooper 0 1 Fast food 24.2 109 20.2 61 32.4 48
Race (n ¼ 414) 87.2% White 0 1 Makeup 24.9 112 20.9 63 33.1 49
State (n ¼ 450) 67.2% Midwest 0 1 Telematic 73.6 331 74.2 224 72.3 107
Gender (n ¼ 416) 86.5% Male 0 1 Other 16.0 72 17.5 53 12.8 19

4
T. Holt and D.S. Dolliver
constitutes objects with evidentiary value.
A small number of respondents also noted the other category
(16%), with differing perspectives on what would need to be done at
the scene. Twenty respondents (4.4%) specifically stated the need to
collect the car's crash data retrieval (CDR) or electronic control unit
(ECU), as this will contain information about vehicle operation at
the time of the crash. Sixteen respondents also noted the need to
photograph the contents of the vehicle at the time of the crash. A
small proportion (n ¼ 12; 2.6%) also noted they would search the
vehicle for GPS systems, or simply impound the entire vehicle
(n ¼ 7; 1.5%).
Some unique relationships were identified with respect to the
items that should be searched and the demographics or experi-
ences of respondents. For instance, females were more likely to
identify mobile devices (c2 ¼ 4.309*; t ¼ 4.848***), as were those
who received training (c2 ¼ 6.045*; t ¼ 2.599**), knew their digital
evidence contact (c2 ¼ 20.616***; t ¼ 3.286***), and had more
recently responded to a scene with digital evidence
(c2 ¼ 21.179***; t ¼ 3.781).
Individuals who knew their digital evidence contact were more
likely to say no to collecting fast food (c2 ¼ 6.599**; t ¼ 2.319*)
and makeup (c2 ¼ 5.723*; t ¼ 2.180*). By contrast, those with
more years of experience were more likely to collect fast food
(t ¼ 2.428*), and makeup (t ¼ 2.985). Older respondents
(c2 ¼ 14.923**; t ¼ 3.079**) were also more likely to collect
makeup. Those who were from the large Southern state were also
more likely to collect fast food (c2 ¼ 8.099**; t ¼ 2.714**) and
makeup (c2 ¼ 7.969**; t ¼ 2.698**).
Those who responded to a scene with digital evidence more
recently were more likely to note the need to collect other materials
(c2 ¼ 14.677*; t ¼ 3.828***), along with those who received digital
forensics training (c2 ¼ 7.197**; t ¼ 2.597**), white officers
(c2 ¼ 3.640*; t ¼ 2.427*), and those with higher education levels
(t ¼ 2.635**). Taken as a whole, these findings suggest that personal
experiences and understanding of digital forensics may be a key
factor to increase responders’ recognition of digital evidence at fatal
crashes in the United States (see also Holt et al., 2019). While these
findings are particular to agencies in two U.S. states, the findings
lend insight to potential broader trends nationally and
internationally.
5. Discussion and conclusions
Digital forensic evidence has become an essential component of
criminal investigations across the United States at all levels of law
enforcement (Casey, 2011; Dolliver, 2019; Holt and Bossler, 2015;
Goodison et al., 2015; Lupariello et al., 2018; Stambaugh et al.,
2001). The use of these materials will only become more com-
mon as technologies continue to evolve, and society becomes even
more dependent on Internet-enabled devices (Dolliver, 2019;
Tuner, 2019). Law enforcement officers at the line level in local and
state agencies are expected to accurately identify and secure digital
devices for later forensic capture by specialized units, individuals,
or task forces (Dolliver et al., 2017; Hinduja, 2007; Holt et al., 2015;
Stambaugh et al., 2001). However, limited evidence suggests line
officers are not comfortable with the practice or processes involved
in digital forensic evidence identification and collection (Holt and
Bossler, 2012; Holt et al., 2010, 2015; Willits and Nowacki, 2016).
As such, this study sought to address this gap in literature by
surveying state law enforcement officers and agents responsible for
investigating such calls for service from a large Midwestern state
and a large Southern state in the U.S.
There are several key implications from this analysis, notably
that training affects one's recognition of digital evidence. Re-
spondents with prior training and field experiences with digital
5
Forensic Science International: Digital Investigation 37 (2021) 301167
evidence were more likely to properly identify and seize such
materials at the scene of fatal vehicle crashes. Across both states,
officers and agents overwhelmingly recognized the need to recover
mobile devices and telematics from the vehicle in the vignette.
Additionally, a substantive number of officers remained unsure of
the potential digital evidentiary value of other objects on-scene
(Rivers, 2011; Van Kirk, 2000). Approximately one-quarter of re-
spondents indicated that they would search for makeup and fast
food from the accident scene. Those respondents were more likely
to be older or have more years of experience respectively, sug-
gesting that there may be generational differences at play when
considering what evidence may have value to an investigation (Holt
et al., 2019).
Officers with fewer years of experience on the job were also less
likely to have received training in investigating online incidents and
crimes with digital components. This may have occurred organi-
cally within the agencies, as less time on the force objectively yields
fewer opportunities for training. This relationship may also indicate
a preference in agencies selectively opting to send more senior
members for training over newer hires (see Holt et al., 2015;
Stambaugh et al., 2001). The latter is potentially problematic, as
more senior members of the agencies are often at higher ranks
within the organization and are closer to retirement. Such in-
dividuals may also be less likely to serve as a first responder at a
fatal vehicle crash, which could minimize the likelihood of proper
identification and collection of digital evidence on-scene (Goodison
et al., 2015; Holt et al., 2015).
As a result, this research underscores the necessity for agencies
in the United States to improve digital evidence training across all
ranks and time on the force for those individuals responding to fatal
traffic accidents and other calls for service (see also Holt et al., 2015;
Kennedy et al., 2019). Indeed, the International Association of
Chiefs of Police (2019) recognized the lack of digital evidence
training among police academy recruits and called for in-service
trainings related to digital evidence identification and recovery. It
is unlikely that such a program could be implemented nationwide
due to the inconsistencies observed across state budgets for
training, particularly around specialized issues like digital evidence
handling and collection (Dolliver, 2019; Dolliver et al., 2017; Holt
et al., 2015).
There may be greater value in implementing consistent digital
and thorough evidence training during academy training for cadets
and recruits in state police agencies (IACP 2019; Stambaugh et al.,
2001). Early exposure to accurate and efficient collection methods
for digital evidence while on-scene could establish baseline
knowledge within generations of state police and improve the
overall response to fatal accidents as the number of smart vehicles
increases over time (see also Kennedy et al., 2019). Since digital
evidence skills also transfer to all criminal case-types, early career
training could improve the long-term capacity of state police
agencies to produce quality evidence for all manner of in-
vestigations, whether in physical or digital spaces (Dolliver, 2019;
Hinduja, 2007; Holt et al., 2015; Stambaugh et al., 2001).
Differences were also observed across respondents on the basis
of their state with regard to experience and preparedness to handle
digital forensic evidence. While the demographic composition of
the two state agencies included in this study were relatively com-
parable aside from their overall size, there were significant opera-
tional differences in digital forensic capabilities. Officers from the
Midwest were more likely to know who to contact in the event they
needed assistance regarding digital evidence recovery while at the
scene of a fatal crash, receive digital evidence and cyber-related
case training, and were more comfortable using a computer. Mid-
western officers were also more likely to be college-educated than
their Southern counterparts. The majority of Southern officers
T. Holt and D.S. Dolliver
recognized the need to seize mobile devices in the scenario, but
they were also more likely to collect fast food and makeup.
These findings call to question what factors shape differences in
the capacities of state agencies. It is possible that the data reflect
differential impacts of budget size and resource allocations for in-
service training and recruitment, as well as state-level variation
in training opportunities for digital forensics in general (Holt et al.,
2015; Stambaugh et al., 2001; Willits and Nowacki, 2016). Addi-
tional research is needed to replicate this study using multiple state
police agencies across the U.S. to better assess the factors affecting
officer competencies (Holt et al., 2019; Lupariello et al., 2018).
The comparative nature of this study also limits it generaliz-
ability to other populations. The response rates for the populations
from the two states (18% and 25%, respectively) were lower than
expected despite multiple follow-up survey reminders. Lower
response rates in survey-based policing research are not uncom-
mon (Groves and Peytcheva, 2008; Nix et al., 2017), and it is
possible that respondents may have purposively avoided taking the
survey or answered questions differently due to various individual
factors. The use of a scenario-based measure also merits further
examination, as the conditions may not fully reflect those experi-
enced in the field. The use of qualitative field studies with local and
state police at traffic accident calls for service could be essential to
better document the ways that evidence is triaged in real time
(Hinduja, 2007; Holt et al., 2015). Such research could also benefit
our understanding of the extent to which evidence may be pulled
from the vehicles involved in accidents relative to the personal
devices of the drivers and passengers involved. Differences in the
digital capacities of vehicles on the road at any time may also limit
their ability to retain evidence, creating variations in the ways law
enforcement can utilize vehicular data collected from scenes
(Kennedy et al., 2019). Thus, future research is essential to disen-
tangle the variety of technological and human factors that may be
involved in fatal accident investigations over time.
Future research should also more thoroughly examine advanced
digital forensic capabilities and data acquisition techniques that
exist at the local and state level law enforcement agencies in the
U.S. (Holt et al., 2015; Willits and Nowacki, 2016) Variations
observed within and across states may impact the rate of successful
case processing, and limit capacity building across the nation.
While police are the front line of criminal investigations, further
research is also required to better understand how well prosecu-
tors, judges, and defense attorneys understand digital forensic
processes (Dolliver, 2019; Holt et al., 2015) Challenges in commu-
nications and comprehension of issues related to evidence collec-
tion, preservation, and analysis may significantly affect trial
outcomes. Finally, this study should be replicated in an interna-
tional context to more fully understand the scope and depth of
digital forensic knowledge; as societies continue to become ever-
more digitally connected, the volume and types of digital evi-
dence will only continue to grow and impact law enforcement
agencies in countries around the world.
Conflict of interest
The authors have no conflict of interest to report.
Acknowledgements
The authors would like to thank the law enforcement agencies
in the two states included in this study for their cooperation and
participation in this research project.
6
Forensic Science International: Digital Investigation 37 (2021) 301167
References
Anderson, M., 2019. Mobile Technology and Home Broadband, 2019. Pew Internet
and American Life Project. https://www.pewinternet.org/2019/06/13/mobile-
technology-and-home-broadband-2019/.
Anderson, M., Jiang, J., 2018. Teens' Social Media Habits and Experiences. Wash-
ington, DC: Pew Internet and American Life Project. Retrieved December, 6,
2018.
Boon, R., 2014. Post-accident analysis of digital sources for traffic accidents. 21st
Twente Student Conference on IT, Enschede, The Netherlands. Accessed via.
https://pdfs.semanticscholar.org/cb7b/
7a83d18ceb66c7c1cfc74f5160a840c652f5.pdf?_ga¼2.25389625.564902324.
1578168814-605327610.1578168814.
Casey, E., 2011. Digital Evidence and Computer Crime: Forensic Science, Computers
and the Internet, third ed. Elsevier, Waltham, MA.
Chan, M., Singhal, A., 2015. Emotion matters: implications for distracted driving. Saf.
Sci. 72, 302e309.
DeAngelo, Gregory, Hansen, Benjamin, 2014. Life and Death in the fast lane: police
Enforcement and traffic fatalities. Am. Econ. J. Econ. Pol. 6 (2), 231e257.
Dimitrakopoulos, G., 2011 August. Intelligent transportation systems based on
internet- connected vehicles: fundamental research areas and challenges. In: In
ITS Telecommunications (ITST), 2011 11th International Conference on, vols.
145e151. IEEE.
Dolliver, Diana S., 2019. Emerging technologies, law enforcement responses, and
national security. I/S. A Journal of Law and Policy for the Information Society 15
(1e2), 123e150.
Dolliver, D.S., Collins, C., Sams, B., 2017. Hybrid approaches to digital forensic in-
vestigations: a comparative analysis in an institutional context. Digit. Invest.:
The International Journal of Digital Forensics & Incident Response 23 (4),
124e137.
Ferguson, G., 2017. The Rise of Big Data Policing: Surveillance, Race, and the Future
of Law Enforcement. NYU Press, NY.
Fishbein, M., Ajzen, I., 1975. Intention and Behavior: An Introduction to Theory and
Research.
Fuentes, J.M., Gonzalez-Tablas, A.I., Ribagorda, A., 2009. Witness-based evidence
generation in vehicular ad-hoc networks. In: Embedded Security in Cars Con-
ference (ESCAR). Accessed via. https://pdfs.semanticscholar.org/f7da/
feb9fc89a23bd234cf44cd104325fdee6d65.pdf?_ga¼2.260378121.564902324.
1578168814-605327610.1578168814.
Gerla, M., Lee, E.-K., Pau, G., Lee, U., 2014 March. Internet of vehicles: from intelli-
gent grid to autonomous cars and vehicular clouds. In: In Internet of Things
(WF-IoT), 2014 IEEE World Forum on. IEEE, Seoul, South Korea, pp. 241e246.
Goodison, S.E., Davis, R.C., Jackson, B.A., 2015. Digital Evidence and the US Criminal
Justice System. Identifying Technology and Other Needs to More Effectively
Acquire and Utilize Digital Evidence. Priority Criminal Justice Needs Initiative.
Rand Corporation, San Diego, CA.
Groves, R.M., Peytcheva, E., 2008. The impact of nonresponse rates on nonresponse
bias. Publ. Opin. Q. 72 (2), 167e189.
Higgins, G., Wilson, A., Fell, B., 2005. An application of deterrence theory to soft-
ware piracy. J. Crim. Justice Popular Cult. 12 (3), 166e184.
Hinduja, S., 2004. Perceptions of local and state law enforcement concerning the
role of computer crime investigative teams. Polic. Int. J. Police Strat. Manag. 27
(3), 341e357. https://doi.org/10.1108/13639510410553103.
Hinduja, S., 2007. Computer crime investigations in the United States: leveraging
knowledge from the past to address the future. International Journal of Cyber
Criminology 1 (1), 1e26.
Holt, T.J., Bossler, A.M., 2012. Police perceptions of computer crimes in two south-
eastern cities: an examination from the viewpoint of patrol officers. Am. J. Crim.
Justice 37 (3), 396e412.
Holt, T.J., Bossler, A.M., 2015. Cybercrime In Progress: Theory and Prevention Of
Technology-Enabled Offenses. Routledge, New York.
Holt, T.J., Bossler, A.M., Fitzgerald, S., 2010. Examining state and local law enforce-
ment perceptions of computer crime. Crime on-line: Correlates, causes, and
context 221e246.
Holt, T.J., Burruss, G.W., Bossler, A., 2015. Policing Cybercrime and Cyberterror.
Carolina Academic Press, Raleigh, NC.
Holt, T.J., Clevenger, S., Navarro, J., 2019. Exploring digital evidence recognition
among officers and troopers in a sample of a state police force. Policing: Int. J.
43 (1).
Horsman, G., Conniss, L., 2015. Investigating evidence of mobile phone usage by
drivers in road traffic accidents. Digit. Invest. 12, 30e37.
2019. IACP. (Accessed 3 May 2021).
International Chiefs of Police, 2019. Understanding digital evidence. Accessed at.
http://www.iacpcybercenter.org/investigators/digital-evidence/understanding-
digital-evidence/.
Kennedy, J., Holt, T., Cheng, B., 2019. Automotive cybersecurity: assessing a new
platform for cybercrime and malicious hacking. J. Crime Justice 42 (5),
632e645.
Kim, M.S., Hunter, J.E., 1993. Relationships among attitudes, behavioral intentions,
and behavior: a meta-analysis of past research, part 2. Commun. Res. 20 (3),
331e364.
Kopylova, Y., Farkas, C., Wenyuan, X., 2011. Accurate accident reconstruction in
VANET. Data and Applications Security and Privacy 6818, 271e279.
Lee, J.R., Holt, T.J., Burruss, G.W., Bossler, A.M., 2019. Examining English and Welsh
T. Holt and D.S. Dolliver
detectives views of online crime. Int. Crim. Justice Rev. https://doi.org/10.1177/
1057567719846224.
Lupariello, F., Curti, S., Duval, J.B., Abbattista, G., Vella, G.D., 2018. Staged crime scene
determination by handling physical and digital evidence: reports and review of
the literature. Forensic Sci. Int. 288, 236e241. https://doi.org/10.1016/
j.forsciint.2018.04.050.
Maras, M.H., 2012. Computer Forensics: Cybercriminals, Law, and Evidence. John &
Bartlett Learning, LLC, New York, NY.
National Center for Statistics and Analysis, 2019. January. Driver Electronic Device
Use in 2017 (Traffic Safety Facts Research Note. Report No. DOT HS 812 665).
National Highway Traffic Safety Administration, Washington, DC.
National Highway Traffic Safety Administration (NHTSA), 2019. Traffic Safety Facts.
U.S. Department of Transportation DOT HS 812 783. National Center for Sta-
tistics and Analysis, Washington, D.C.
National Institute of Justice (NIJ), 2008. Electronic Crime Science Investigation: A
Guide for First Responders, second ed. U.S. Department of Justice, National
Institute of Justice, Washington, DC.
Nilsson, D., Phung, P., Larson, U., 2018. Vehicle ECU classification based on safety-
security characteristics. IEEE Xplore. https://doi.org/10.1049/ic.2008.0810.
Nix, J., Pickett, J., Baek, H., Alpert, G., 2017. Police research, officer surveys, and
response rates. Polic. Soc. 29 (5), 530e550.
Novak, M. A. R. T. I. N., Grier, J., Gonzales, D. A. N. I. E. L., 2018. New approaches to
digital evidence acquisition and analysis. NIJ Journal No 280.
Oulasvirta, A., Rattenbury, T., Ma, L., Raita, E., 2012. Habits make smartphone use
more pervasive. Personal Ubiquitous Comput. 16 (1), 105e114.
Overton, T.L., Rives, T.E., Hecht, C., Shafi, S., Gandhi, R.R., 2015. Distracted driving:
Forensic Science International: Digital Investigation 37 (2021) 301167
prevalence, problems, and prevention. Int. J. Inj. Contr. Saf. Promot. 22 (3),
187e192.
Piquero, A.R., Bouffard, J.A., 2007. Something old, something new: a preliminary
investigation of Hirschi's redefined self-control. Justice Q. JQ 24 (1), 1e27.
Rivers, R.W., 2011. Traffic Accident Investigators' Handbook, third ed. Charles C.
Thomas Publishers, Springfield, IL.
Schmelzer, R., 2019. What happens when self-driving cars kill people? Forbes.
September 26, 2019. https://www.forbes.com/sites/cognitiveworld/2019/09/26/
what-happens-with-self-driving-cars-kill-people/#472738c3405c.
Senjo, S., 2004. An analysis of computer-related crime: comparing police officer
perceptions with empirical data. Sec. J. 17, 55e71.
Stambaugh, H., Beaupre, D.S., Icove, D.J., Baker, R., Cassaday, W., Williams, W.P.,
2001. Electronic Crime Needs Assessment for State and Local Law Enforcement
Series. NCJ. Retrieved from. https://www.ncjrs.gov/txtfiles1/nij/186276.txt.
Tene, O., 2008. What google knows: privacy and internet search engines. Utah Law
Rev. 1433.
Tuner, J.L., 2019. Managing digital discovery in criminal cases. J. Crim. Law Criminol.
109 (2), 237e311.
Van Kirk, D.J., 2000. Vehicular Accident Investigation and Reconstruction. Crc Press.
Walker, S., Katz, C.M., 2012. Police in America. McGraw-Hill.
Willits, D., Nowacki, J., 2016. The use of specialized cybercrime policing units: an
organizational analysis. Crim. Justice Stud. Crit. J. Crime Law Soc. 29 (2),
105e124.
Wilson, F.A., Stimpson, J.P., 2010. Trends in fatalities from distracted driving in the
United States, 1999 to 2008. Am. J. Publ. Health 100 (11), 2213e2219.