THE USE AND IMPACT OF DIGITAL FORENSICS EXAMINATION IN THE

GHANAIAN CRIMINAL JUSTICE SYSTEM

Awareness of Digital forensics examination

1. Tell me about your professional background.
a. What is your current job title?
E-Crime (Forensic Expert)

b. What are your primary job duties?

My job is to retrieve, catalogue, and safeguard digital data related to cybercrime investigations. I am
also in charge of preserving evidence to ensure its admissibility in court. I normally also advise other
investigators about the value of digital evidence and Train Judges that mostly handle of Case in court.

I must do this training most often so that Judges and court clerks have an understanding of the
importance of digital evidence and the interpretation of this data.

I am also involved in all the processes of the digital forensics process. That is from evidence seizure to
the preservation and all the way to scanning and retrieving evidence.

c. How long have you been a (digital forensics examiner/attorney)?

10 years’ experience in both in-house and field.
2. Do you feel your knowledge of digital forensics is adequate to fulfil your job duties?
Well, I will say Yes for Now. Nevertheless, the current trends of cybercrime and large data
acquisition have made me understand there is more room for improvement. Mostly it takes days
and months to gather enough evidence from a suspect. Some victims have encrypted data and
passwords that may stall you for days. If the suspect is unable to corporate with the
investigation, the evidence may not even be retrieved.

3. The following questions are related to common knowledge of digital devices/technologies.

a. Please name a few items you would consider to be digital evidence.
1. Analogical Evidence
Analogical evidence, as the name suggests, compares similar things in order to clarify or
explain what has happened.
2. Anecdotal Evidence
Anecdotal evidence comes in the form of retellings of events from parties involved in the
investigation.
3. Circumstantial Evidence
Also known as indirect evidence, circumstantial evidence is used to infer something
based on a series of facts separate from the fact the argument is trying to prove.
 4. Digital Evidence
Digital evidence can be any sort of digital file from an electronic source. This includes
email, text messages, instant messages, social media posts, files and documents
extracted from hard drives, electronic financial transactions, audio files, and video files.
5. Forensic Evidence
Forensic evidence is scientific evidence, such as DNA, trace evidence, fingerprints, or
ballistics reports, and can provide proof to establish a person’s guilt or innocence.
Forensic evidence is generally considered to be strong and reliable evidence and
alongside helping to convict criminals, its role in exonerating the innocent has been well
documented

b. How do you primarily learn about emerging technologies?

Mostly, for experience and research, we turn to learn more ideas. Also, for Journals and
Technology publications. Also we have regular training out of the country.
4. On a scale of 1 to 5 describe your familiarity with IT, computers, and forensics.
Where 1= low; 2=below average; 3=average; 4= above average; 5=High

1 2 3 4 5
Digital Evidence 5
Computer Forensic Process 5
Computer Technology 5
Internet Applications 5

5. Do you feel the involvement of forensic evidence, in general, makes a case more or less
complicated than a case not involving forensic evidence?
Yes
a. Why do you feel this way?
Basically, the forensics side of evidence gathering and interpretation is quite very new
and complicated for a lot of Judges. That is why there is a need for more training and
observation.
b. Does your feeling depend on the type of forensic evidence?
Yes

8. (Attorneys only) Have you ever used a digital forensic expert to assist in any of your cases?
a. What types of services did they perform? (Case review, forensic analysis, reporting,
testimony, etc.)
b. What characteristics of the individual helps in admitting him/her as an expert witness in
court?
c. What were the factors that prompted you to consider or hire such an expert?
d. In what ways, if any, did you find the court's expert helpful?
e. How, if at all, do you think that the use of such an expert affected the outcome of the
case?
9. Tell me about recommendations that you might make to other judges to improve their own
knowledge and awareness of digital forensic evidence.

10. In general, how do you think the use of digital forensics method has influenced the delivery
of justice in our court?

Digital Forensics (Digital forensic scientist only)

10. Is there any standardized procedure you follow during any forensics examination?
No and yes. But basically, we follow the data protection Act in all our activities.
Every case is treated differently. Evidence is gathered differently, but all in line with the ethics of
the Job. Some cases may involve a phone as evidence. In this case, we may need a court order
for both seizure and data analysis and collection. But if we only get a seizure we can’t temper
with the phone, therefore a smart suspect can connect through the device online and may wipe
all evidence or even encrypt them.
11. What procedure do you use during forensic examinations?
We basically for this step to arrive at our final result.
1. Collection – This is provided by the Crime Department
2. Examination - This done when we have a court order to procced
3. Cloning: A replica of the device or data is created.
4. Extraction- data is retrieve from the device
5. Analysis – The is done on the device
6. Reporting – we document the finding
7. Interpretation – We may or may not be ask to testify in court base on the gravity of the
evidence provided
12. Do you use any software/application/algorithm to extract evidence from a digital device?
Yes.
1. EnCase
2. Autopsy/The Sleuth Kit
Factors Influencing Digital forensics
13. From a scale of 1 to 5 describe how the following influences digital forensics investigation.
Where 1= low; 2=below average; 3=average; 4= above average; 5=High

Factors 1 2 3 4 5
Heterogeneous sources of data 5
Expanding the diversity of digital devices 5
Diversity of data 5
anti-forensics (such as artefact wiping, data hiding, trail 5
obfuscation, data encryption, and attacks against
computer forensics tools and processes)
Big volume of data 5
Legal requirements such as compliance with the law 5
Efficiency of digital forensic departments 5