Privileged Data within Digital Evidence

TL;DR

This paper addresses the challenge of handling privileged data in digital forensics by developing a script for Nuix that automates filtering and improves effectiveness through content-based relations.

Contribution

It introduces a novel script for Nuix that automates privileged data handling and enhances filtering effectiveness using content relation technology.

Findings

The script improves filtering effectiveness over traditional methods.

Content-based relations help identify privileged documents more accurately.

Digital forensic tools currently have limitations in handling privileged data.

Abstract

In recent years the use of digital communication has increased. This also increased the chance to find privileged data in the digital evidence. Privileged data is protected by law from viewing by anyone other than the client. It is up to the digital investigator to handle this privileged data properly without being able to view the contents. Procedures on handling this information are available, but do not provide any practical information nor is it known how effective filtering is. The objective of this paper is to describe the handling of privileged data in the current digital forensic tools and the creation of a script within the digital forensic tool Nuix. The script automates the handling of privileged data to minimize the exposure of the contents to the digital investigator. The script also utilizes technology within Nuix that extends the automated search of identical privileged document to relate files based on their contents. A comparison of the 'traditional' ways of filtering within the digital forensic tools and the script written in Nuix showed that digital forensic tools are still limited when used on privileged data. The script manages to increase the effectiveness as direct result of the use of relations based on file content.