The implementation of digital forensic science in a Swiss police force

To contribute to the understanding of the operationalisation of digital forensic science and the associated challenges, this study observes daily practices and interactions of a digital forensic unit. The observation was focused on four main questions: (1) What are the primary missions of a DFU? (2) What workflow procedures do DFUs use in performing their duties? (3) How useful are DFUs and digital traces at various stages of an investigation? (4) What obstacles do DFUs face in fulfilling their missions? This study draws on 160 hours of field observations conducted between January and March 2020 in a Swiss police force, the analysis of the unit internal casework database (2018-2019 past cases) and 6 semi-structured interviews with different stakeholders. The study is divided between an active participation in the digital forensic work (handling, analysing digital objects and reporting) and a passive participation in field work. Different uses and expectations of the digital forensic unit services depending on the investigation context were observed during the analysis of the field search notes, casework database and while conducting the interviews. The findings also allowed for the categorization and timelining of the types of activities conducted by a digital forensic unit. • Categorisation of digital forensic science (DFS) unit activities. • Discussion of challenges in operationalising digital forensic science. • Concrete examples demonstrating DFS work throughout investigations.