Graeme Horsman

Graeme Horsman
Teesside University

BSc, MJur, PhD

About

82
Publications
13,337
Reads
How we measure 'reads'
A 'read' is counted each time someone views a publication summary (such as the title, abstract, and list of authors), clicks on a figure, or views or downloads the full-text. Learn more
575
Citations

Publications

Publications (82)
Article
As we now see digital evidence play a role in many investigative scenarios, it is imperative that those seeking to rely upon it as part of criminal justice processes can do so, absent any concern regarding its validity. Interpreting the meaning of digital data and its potential value to a criminal inquiry as part of a digital forensic examination i...
Article
As those tasked with investigating incidents regularly encounter the need to examine content on associated digital devices, there is a need to ensure this task is carried out both effectively and efficiently. In addition to the traditional digital forensic examination workflow, in some cases first responders/investigators have the option to ‘manual...
Article
In light of the advancements in computing technology, and an increase in the use of mobile devices, various forms of services have emerged in recent times. Particularly, audiovisual (AV) content-based services that stream broadcasts through personal channels or self-produced video content shared with friends has been gaining ground. It is evolving...
Article
As digital devices play an increasing role in criminal investigations, where in some cases the data they contain may describe events where few other sources of information exist, there is an increasing concern regarding potential privacy invasion caused by their examination. ICO, 2020, the Information Commissioner's Office called for the greater ev...
Article
Given the importance of digital evidence to many inquiries, the services of practitioners in the digital forensic field are often sought. In some cases, a “digital forensic expert witness” may be required to conduct specific investigatory work and provide opinion evidence. Here we explore the concept of a digital forensic expert witness while also...
Article
Full-text available
As digital forensics continues to play an important role in criminal investigations, it is crucial that its investigative work is underpinned with well-defined and robust methodologies. Over the last 20 years, a substantial body of research has been produced aimed to define and codify the digital forensic investigation process and the stages/sub-pr...
Article
Data acquisition is a fundamental stage of the digital forensic workflow, where without it, it may not be possible to conduct many criminal inquiries effectively. While any investigative team may want access to all digital data available, it is no longer an approach that is considered justifiable or proportionate in all cases. There is now an incre...
Article
The prominence of technology usage in society has inevitably led to increasing numbers of digital devices being seized, where digital evidence often features in criminal investigations. Such demand has left well documented backlogs placing pressure on digital forensic labs, where in an effort to combat this issue, the ‘at-scene triage’ of devices h...
Article
As part of their role, digital forensic practitioners are often faced with case‐specific investigative inquiries which they must attempt to address and provide an appropriate answer to their client. Such investigative questions can take many forms wherein every instance, any response they offer must be reliable. To be reliable, any response to an i...
Article
Many criminal investigations maintain an element of digital evidence, where it is the role of the first responder in many cases to both identify its presence at any crime scene, and assess its worth. Whilst in some instances the existence and role of a digital device at-scene may be obvious, in others, the first responder will be required to evalua...
Article
As demand for support from the digital forensic science discipline by criminal justice systems continues to remain high, there is a need to ensure that this field can sustain its valuable contribution to many investigations. With well documented backlogs and the presence of relevant digital behaviour documented on devices in many criminal cases mea...
Article
The prevalence of digital devices in society, and the volume and types of data they contain now means that first responders should be encouraged to consider the presence of any ‘digital investigative opportunities’ at-scene, and evaluate their potential relevance to a given inquiry. This task is far from straightforward where case outcomes can be d...
Article
As the digital forensic field develops, taking steps towards ensuring a level of reliability in the processes implemented by its practitioners, emphasis on the need for effective testing has increased. In order to test, test datasets are required, but creating these is not a straightforward task. A poorly constructed and documented test dataset und...
Article
Given the complexity of many examination-scenarios, practitioners in the field of digital forensics should consider the production and maintenance of contemporaneous notes a core part of any examination process. Not only do contemporaneous notes support the practitioner as they conduct their case work, through to the production of any accompanying...
Article
The importance of ensuring the results of any digital forensic (DF) examination are effectively communicated cannot be understated. In most cases, this communication will be done via written report, yet despite this there is arguably limited best practice guidance available which is specific for this field in regards to report construction. Poor re...
Article
Full-text available
As a topic area, the need for the standardization of operational practices in digital forensics has seen much discussion. There are clear benefits for digital forensics if its procedures can be harmonized including increasing the reliability of the work produced by its practitioners, consistency of practice, and the potential for greater quality co...
Article
Full-text available
This work forms the second part of a two part series providing the necessary scaffolding for the digital forensic discipline to conduct effective peer review in their laboratories and units. The first part articulated the need for a structured approach to peer review in digital forensic investigations (Horsman and Sunde, 2020). Here in part two, th...
Article
Full-text available
This work forms the second part of a two part series providing the necessary scaffolding for the digital forensic discipline to conduct effective peer review in their laboratories and units. The first part articulated the need for a structured approach to peer review in digital forensic investigations (Horsman and Sunde, 2020). Here in part two, th...
Article
As digital evidence now features prominently in many criminal investigations, such large volumes of requests for the forensic examination of devices has led to well publicized backlogs and delays. In an effort to cope, triage policies are frequently implemented in order to reduce the number of digital devices which are seized unnecessarily. Often f...
Article
Full-text available
The importance of peer review in the field of digital forensics cannot be underestimated as it often forms the primary, and sometimes only form of quality assurance process an organisation will apply to their practitioners' casework. Whilst there is clear value in the peer review process, it remains an area which is arguably undervalued and under-r...
Article
Non-local forms of file storage and transfer provide investigatory concerns. Whilst mainstream cloud providers offer a well-established challenge to those involved in criminal enquiries, there are also a host of services offering non-account based ‘anonymous’ online temporary file storage and transfer. From the context of a digital forensic investi...
Article
Those subject to supervision orders requiring the lawful regulation of their Internet activity provide an investigatory challenge to law enforcement practitioners. Where a defendant's Internet history must be retained and made accessible for review at defined intervals, investigators must apply principles of digital triage to quickly evaluate exist...
Article
Despite many academic studies in the last 15 years acknowledging the investigative value of physical memory due to the potential sensitive nature of data it may contain, it arguably remains rarely collected at-scene in most criminal investigations. Whilst this may be due to factors such as first responders lacking the technical skills to do this ta...
Article
Digital devices now play an important role in the lives of many in society. Whilst they are used predominantly for legitimate purposes, instances of digital crime are witnessed, where determining their usage is important to any criminal investigation. Typically, when determining who has used a digital device, digital forensic analysis is utilised,...
Article
Horsman, Graeme (2020) "What’s in the Cloud? - An examination of the impact of cloud storage usage on the browser cache.," Journal of Digital Forensics, Security and Law: Vol. 15 : No. 1 , Article 3.
Article
Whilst the field of digital forensics is now well established, its research community can be considered relatively emerging in comparison to the associated areas of traditional forensic and computer sciences. As a result, this comment article takes a quick look at the demographics of digital forensics research over the last 20 years, with metadata...
Article
Consistency is a term which should be used cautiously in the context of digital forensics (DF). Its meaning indicates regular, repeatable performance, where with regards to the undertaking of forensic analysis procedures, such behaviour is synonymous with the traits of reliability and trustworthiness, which in turn provides a foundation for derivin...
Article
Full-text available
Digital forensic practitioners are increasingly facing examinations which are both complex in nature and structure. Throughout this process, during the examination and analysis phases, the practitioner is constantly drawing logical inferences which will be reflected in the reporting of results. Therefore, it is important to expose how all the eleme...
Article
Whilst many other traditional forensic science disciplines are encouraged to describe the weight of their evidence in some form of quantifiable measurement/expression, this is rarely done in digital forensics. There are calls to rectify this situation, suggesting that the field should begin to develop more robust, scientific methods for evaluating...
Article
Full-text available
Despite remaining largely unchanged for over 10 years, the Association of Chief Police Officers’s [1] Good Practice Guides for Digital Evidence and their four governing principles for evidence handling are amongst some of the most cited pieces of digital forensic best practice advice. However, given the pace of change in both technology and the fie...
Article
In 2018, Horsman (2018a; 2018b) provided guidance for the reconstruction of cached stream remnants following use of the Periscope, Facebook Live and YouTube platforms. These works confirmed that video stream content can be cached to a local device when viewed via an Internet browser, and that following the provided methodology, video content can be...
Article
The problems faced with regulating social media platforms are well known and documented, where frequent abuses of these platforms occur. In addition to this issue, the use of gaming platforms and their inbuilt communication facilities to carry out malicious acts including hate crimes and grooming is now an increasing concern. The regulation of gami...
Article
Full-text available
Private browsing facilities are part of many mainstream Internet browsing applications and arguably, there is now more awareness of their function and purpose by the average Internet user. As a result the potential for those engaging in malicious and/or illegal browsing behaviours, to do so in a ‘privatised’ way is increased. Many private browsing...
Article
Full-text available
Despite potential numerous benefits, the field-wide sharing of knowledge in digital forensics is arguably still yet to be attained. Achieving this has attracted much practitioner and academic debate, yet solutions to two fundamental hurdles have yet to arguably be addressed; ‘how do we share knowledge’, and ‘what do we share’. Currently there a few...
Article
Full-text available
Quality assurance measures in the field of digital forensics play a vital role for upholding and developing investigatory standards. Coupled with the fast pace of technology, practitioners in this discipline are often faced with the challenge of interpreting previously unseen or undocmented forms of potentially evidential digital data, content whic...
Article
Whilst difficult to ascertain the full extent to which so called anti-forensic software applications are in use by the public, their threat to an investigation of digital content is tangible, where of particular interest is the use of file wiping tools, which remains the focus of this work. This work presents the examination of eight freely availab...
Article
There are an abundance of measures available to the standard digital device users which provide the opportunity to act in an anti-forensic manner and conceal any potential digital evidence denoting a criminal act. Whilst there is a lack of empirical evidence which evaluates the scale of this threat to digital forensic investigations leaving the tru...
Article
Full-text available
In digital forensics, the concept of a ‘digital artefact’ exists; coined here as ‘a digital object containing data which may describe the past, present or future use or function of a piece of software, application or device for which it is attributable to’. In almost all digital investigations, a practitioner will query any digital artefacts reside...
Article
Full-text available
The challenges of tackling increasing caseloads, large volumes of digital data and maintaining examination efficiency in order to adhere to tight criminal justice system deadlines persist. As the field looks towards techniques for improving efficiency, forms of automation are both simultaneously touted as a potential solution, whilst also attractin...
Article
In the field of digital forensics it is crucial for any practitioner to possess the ability to make reliable investigative decisions which result in the reporting of credible evidence. This competency should be considered a core attribute of a practitioner's skill set and it is often taken for granted that all practitioners possess this ability; in...
Article
As the majority of dwellings now maintain some form of Internet connectivity, the examination of routers at crime scenes is an increasing requirement. Due to cost and resourcing constraints, police forces are looking to transfer responsibility for carrying out this task to front line crime scene investigators, despite such staff typically lacking s...
Article
Western civilization faces the challenge of policing an evolved form of terror attack, one that is suspected of being underpinned with communication between individuals on encrypted channels. This article reviews the challenges encryption provided in 2017 while considering the feasibility and issues surrounding its removal.
Article
The digital forensic discipline is wholly reliant upon software applications and tools designed and marketed for the acquisition, display and interpretation of digital data. The results of any subsequent investigation using such tools must be reliable and repeatable whilst supporting the establishment of fact, allowing criminal justice proceedings...
Article
Video streaming provision are now widely used and whilst commercialised platforms face challenges with accessing and protecting copyrighted media, the emerging popularity of personalised live streaming services has resulted in a number of additional recorded abuses. In 2017, reports of personal live streaming platforms being used in acts of harassm...
Article
Mobile devices continue to feature heavily in criminal investigations and often bear multiple forms of potentially relevant evidence. In the context of identifying the owner of a device, both latent fingerprints and resident digital data may be crucial to investigations, yet each individual process may have a detrimental impact on the other. Finger...
Article
With a reliance on the various forms of forensic science evidence in complex criminal investigations, the measures for ensuring its quality are facing increasing scrutiny. Improvements to quality management systems, to ensure both the robust application of scientific principles and the accurate interpretation and reporting of results, have arisen a...
Article
The Microsoft Windows operating system continues to dominate the desktop computing market. With such high levels of usage comes an inferred likelihood of digital forensic practitioners encountering this platform during their investigations. As part of any forensic examination of a digital device, operating system artifacts, which support the identi...
Article
Full-text available
With the increased popularity of online video streaming comes the risk of this technology's subsequent abuse. With a number of cases noted in 2017 where individuals have engaged with illegal or policy breaching video content, digital forensics practitioners are often tasked with investigating the subsequent ‘fingerprint’ of such acts. This is often...
Article
The use of search engines and associated search functions to locate content online is now common practice. As a result, a forensic examination of a suspect's online search activity can be a critical aspect in establishing whether an offense has been committed in many investigations. This article offers an analysis of online search URL structures to...
Article
Following the enactment of the Police and Crime Act 2017, subsequent amendments to the Police and Criminal Evidence Act 1984 have seen a ‘cap’ placed on the length of time a suspect can be released on bail; a process commonly referred to as ‘police bail’ or ‘pre-charge bail’. Whilst designed to instil consistency and certainty into bail processes t...
Article
The forensic analysis of mobile handsets is becoming a more prominent factor in many criminal investigations. Despite such devices frequently storing relevant evidential content to support an investigation, accessing this information is becoming an increasingly difficult task due to enhanced effective security features. Where access to a device's r...
Article
The field of digital forensics maintains significant reliance on the software it uses to acquire and investigate forms of digital evidence. Without these tools, analysis of digital devices would often not be possible. Despite such levels of reliance, techniques for validating digital forensic software are sparse and research is limited in both volu...
Article
By default, all major web browsing applications cache visited website content to the local disk to improve browser efficiency and enhance user experience. As a result of this action, the cache provides a window of opportunity for the digital forensic practitioner to establish the nature of the content which was hosted on the websites which had been...
Article
With an increase in the creation and maintenance of personal websites, web content management systems are now frequently utilized. Such systems offer a low cost and simple solution for those seeking to develop an online presence, and subsequently, a platform from which reported defamatory content, abuse, and copyright infringement has been witnesse...
Article
The establishment of fact forms the cornerstone of any forensic discipline, with digital analysis being no exception. Practitioners are under an obligation as expert witnesses to provide factual accounts of digital scenarios, which must be underpinned by robust knowledge and evidential findings. To achieve this level of reliability, investigatory r...
Article
Twitter remains one of the most popular social media network sites in use today and continues to attract criticism over the volume of unsavoury and illegal content circulated by its users. When breaches of legislation occur, appropriate officials are left with the task of identifying and apprehending the physical user of an offending account, which...
Conference Paper
Virtual reality is an emergent technology with the potential to offer valuable contributions to ambient assisted living. For example, it can be utilised to enhance equality of access to, and ease of use of technology. This paper introduces virtual reality technology, and presents a prototype system for intuitive file navigation and manipulation. Th...
Article
Now approximately 30 years old, the field of digital forensics is arguably facing some of its greatest challenges to date. Whilst currently supporting law enforcement in numerous criminal cases annually, questions are beginning to emerge regarding whether it can sustain this contribution, with digital crime remaining prevalent. In his first live in...
Article
In England and Wales, there are four main categories of offence surrounding images depicting child sexual abuse, those of making/taking, publishing, distributing and possession. Despite being in force for almost 40 years, it is argued that now, additional regulation is required. In response to technological provision such as private browsing, strea...
Article
Online forms of harassment, stalking and bullying on social network and communication platforms are now arguably wide-spread and subject to regular media coverage. As these provision continue to attract millions of users, generating significant volumes of traffic, regulating abuse and effectively reprimanding those who are involved in it, is a diff...
Article
As unmanned aerial vehicles have become more affordable, their popularity with the general public and commercial organisations has seen significant growth in recent years. Whilst remaining a device for both the hobbyist and aircraft-enthusiast to enjoy, they are now also used for carrying out activities such as law enforcement surveillance, agricul...
Article
In 2015, offences surrounding the possession, distributing, creation and publication of images depicting child sexual abuse (IDCSA) are prevalent. As a result, it is well publicised that law enforcement and associated digital forensic organisations are incurring substantial case backlogs in this area. As more investigations of this type are faced,...
Article
In 2012, the United Kingdom actively sought to tackle acts of stalking through amendments to the Protection from Harassment Act 1997. Now, not only is stalking a recognised criminal offence, acts associated with stalking behaviour have finally been properly defined in legislation. Further, the role of technology in digital stalking offences, freque...
Article
This article presents an analysis of the regulatory challenges posed by anonymous communication applications in the United Kingdom, which are in widespread use largely due to the online privacy sought by individuals. However, protecting individuals through the use of anonymous applications presents a serious problem in terms of offender identificat...
Article
Full-text available
The United Kingdom is witnessing some of the highest volumes of motor vehicle traffic on its roads. In addition, a large number of motor vehicle traffic accidents are reported annually, of which it is estimated that a quarter involve the illegal use of a hand-held mobile device by the driver. Establishing whether mobile phone usage was a causal fac...
Article
The role of triage in digital forensics is disputed, with some practitioners questioning its reliability for identifying evidential data. Although successfully implemented in the field of medicine, triage has not established itself to the same degree in digital forensics. This article presents a novel approach to triage for digital forensics. Case-...
Conference Paper
Motivated by the concerns expressed by many academics over difficulties facing the digital forensic field, user-contributory case-based reasoning (UCCBR); a method for auditing digital forensic investigations is presented. This auditing methodology is not designed to replace a digital forensic practitioner but to aid their investigation process, ac...
Conference Paper
A novel concept for approaching digital investigations is presented. User-contributory case-based reasoning (UCCBR) is a method by which previous results from digital forensic (DF) examinations are stored and reused in future investigations. The advantages of a UCCBR system are discussed which include implementing UCCBR as an auditing tool, a metho...
Conference Paper
A novel concept for improving the trustworthiness of results obtained from digital investigations is presented. Case Based Reasoning Forensic Auditor (CBR-FA) is a method by which results from previous digital forensic examinations are stored and reused to audit current digital forensic investigations. CBR-FA provides a method for evaluating digita...

Questions

Question (1)
Question
Does anyone have any thoughts on standardisation of terminology in digital forensic reports - does anyone adhere to any specific standards?

Network

Cited By