
Digital Forensics
with Detective Sergeant John PriceOn this episode, host Olivia Neal speaks to Detective Sergeant John Price from the West Midlands Police Force in the United Kingdom. He shares insights from the world of digital forensics.

This is a show for anyone who cares about using digital approaches in the public sector to deliver better outcomes. We explore stories from around the world, where public servants have been successful at driving change. We meet the people behind the stories, to hear their first-hand experiences and lessons learned. Throughout the series we discuss technology and trends, as well as the cultural aspects of making change happen.
In this episode, host Olivia Neal speaks with Detective Sergeant John Price from the West Midlands Police Force in the United Kingdom. He shares insights from the world of digital forensics and how investigators are using technology to help victims more effectively in the modern age.
Olivia Neal [host] |Ā LinkedInĀ
John Price [guest] | LinkedIn
Microsoft Public Sector Center of Expertise for more information and transcripts of all episodes
Discover and follow other Microsoft podcasts at aka.ms/microsoft/podcasts

Episode summary
On this episode, host Olivia Neal speaks to Detective Sergeant John Price from the West Midlands Police Force in the United Kingdom. He shares insights from the world of digital forensics and how investigators are using technology to help victims more effectively in the modern age.
Listen to this episode on any of these podcast platforms:
Digital Forensics
On this episode, host Olivia Neal speaks to Detective Sergeant John Price from the West Midlands Police Force in the United Kingdom. He shares insights from the world of digital forensics and how investigators are using technology to help victims more effectively in the modern age.
What is digital forensics?
John Price is Detective Sergeant for West Midlands Police Force in the UK. He says āWeāre made up of around about 10,000 police officers and police staff. We currently police a community of around three million people. We also provide a digital forensics division for Warwickshire Police, and they have about a thousand police officers, and about a half-million population.ā
Digital Forensics is a branch of forensic science that focuses on identifying, acquiring, processing, and the reporting of data stored electronically.
āThat data covers almost all criminal activities, digital forensics support, crucial law enforcement investigations. Itās estimated around the United Kingdom, that around 90% of crimes have some form of digital footprint, either thatāll be computers, mobile phones, CCTV, drones, internet of things in the house, and we report upon that, so thereās a lot of data there.ā
Price added, āOur main goal with digital forensics is to extract data from electronic devices, processing into actionable intelligence, and produce that back for courts. But thereās also a world of digital forensics, outside of policing, which is more around digital forensics incident response, which is identifying and investigating incidents within corporate environments, for example, cybersecurity incidents. And that can be anything from looking at dead-box forensics, which is devices that switched off, anywhere from looking at security information, event monitoring logs, firewall routers, overlaying all of that data to look at that security incident, and how do we deal with it, and look at what data systems processes are being impacted.ā
Technology is increasing challenges, and also opportunities
āI look back to when I joined the police, and if youād go into a house search or a premises search, you would probably go there and youād be lucky to find a computer in one room of the house and a mobile phone. And that wasnāt a smartphone. It was just a normal conventional, old style Nokia phone, for example. Whereas when we go into a house nowadays, weāve got Ring doorbell systems, for example, which is capturing peopleās movements. Weāve got so many Internet of Things devices, youāve got smart TVs.ā
Price continued, āWe can capture now so much more data around people, incidents, profiling, compared to 10 to 20 years ago. And we donāt ever see any of this getting dis-invented. All we ever see is that this is going to continue; that innovation cycle is going to get more and moreā¦ I think this is one area thatās just getting bigger and bigger around digital investigations.ā
Having so much new technology to work with opens up a lot of possibilities in Priceās line of work, but it also creates a lot of data.
āI look back around about 2010, and we were dealing with hard drives, for example, where the average size of the drive was around about 500 gigabytes, where weāre seeing now devices coming in of about 1.5 terabytes. An average case, for us, for example, is probably around about four terabytes. So dealing with that sheer volume of data coming in, we have to look at ways of how can we innovate to deal with these; the amount of devices coming into us, but also that sheer volume of data that weāre having to go through to make sure that weāre not missing anything of real keen interest.ā
The UKās Digital Forensic Science Strategy
āBack in July 2020, there was a national digital forensic science strategy that was released. And that sets out the goal for the United Kingdom digital forensics between 2020 and 2030. And there were three core challenges that were really identified within that. And that was dealing with the volume of data and devices that weāre seeing coming in. Dealing with the complexities of that data would be around, encryption, different types of devices, the legitimacy that even though weāve got those devices, does it make it right, for example, is it lawful, proportionate? Once weāve got that data, how do we lawfully deal with that?ā
Price added, āAnd then there were other pressing issues around that, that were linked to those core challenges, which were the sheer volume of data, the competency of staff. How do we deal with the quality? So it was encapsulating all those areas and saying to senior leaders in place in the UK and the government, weāve got to start acting upon all these areas, to start making a big impact around digital investigations.ā
āSo back around 2020, we commenced work looking at how we implemented a Digital Review Tool into West Midlands policing. And from that, we worked with three partners. One of those partners was Microsoft. A second partner was a company called Exterro, and a company called Risual, a managed service provider for us.ā
āWhat we wanted to do with all that data we capture within the digital forensic lab, we wanted a way of allowing officers, investigators out there to remotely be able to review the data we hold in the DF lab, therefore reducing the amount of time it takes for staff to review that data, dealing with the issues where they may not have CD burners, Blu-ray discs, DVDs, on the laptops, for example. They may not have the right codex; they may not have the right skill level. So itās something really simplistic for staff to use. In May 2022, we went live with our review tool for certain elements of West Midlands Police, to how we can deal with some of that volume of cases coming in.ā
Different types of online crimes
āWithin West Midlands Police originally, it was going be just a proof of concept. We then put this into an operational production model from May last year. So our phase one has taken, you know, what we call our OCSET team, and thatās our Online Child Sexual Exploitation Team, and itās taken on a few more sensitive teams in full. If we just deal with the OCSET team, first, whatās been quite interesting is, for the vast majority of offending, weāve seen devices coming in ā theyāre mainly computer-oriented exhibits, and computers by sheer nature have that larger increase in volume of storage.ā
Price continued, āIf we were to look across the rest of the force, the different top crime types like murders, homicides, kidnapping you donāt really see that activity taking place in the computer world, itās more mobile based. So even from phase one, I think whatās been really sort of satisfying for us is to think weāve automatically encapsulated a massive piece of that storage data requirements, even from phase one alone, And I think also knowing the teams that itās gone to, as part of that phase one, around the sensitivity of data, you know, to go through all those security hurdles, vetting, and all that pen testing has given us the confidence we know what weāre doing is the right thing.ā
Supporting positive outcomes for victims of crime
āOn the whole, this project, and the delivery of this, it is solely around our victims, nothing more, nothing less. Itās solely around our victims, and unfortunately, there are really sad occasions, when we were working, if a device coming in submission and itās said to us, for example, the report is a person is downloading indecent images on the internet, we would go into that with low risk of score, and that data would have been acquired. It would have been processed. It then would have sat on our server storage for a minimum of six months downstairs until a report writer becomes free, and then they pick it up. But within that six months, realistically, no one is looking at that data due to the sheer volume size and the amount of jobs.ā
Priced added, āHowever, what we found in the Review Tool is because we put that information across one of our databases called CAID, which in the UK is our child abuse imagery database, weāre able to recognize and pre-categorize any indecent images that are flagged whilst itās processing on the fly. So, it can be instantaneous, but itās also flagging up, for example, any indications of what we call live abuse, where those images havenāt been seen before, and children are at risk. So, we have been able, through this tool, to identify children at risk a lot sooner, to take that safeguarding and deal with those offenders a lot quicker than we have done previously, using our old methods.ā
Using cloud to manage volume increases
āFrom May 2022, when we went operationally live, until December of last year, weāve processed over 70 cases in the review tool, and this is equated to 120 mobile devices, 135 computers, but also whatās been really good from that is, as a byproduct of hosting the review tool within Azure, weāve been able to leverage further storage now for our evidential data.ā
Price continued, āAnd since August of last year, weāve pushed up over 400 cases, into Azure, which is, you know, pretty groundbreaking, really, and ā and the benefits of that, around management of policing information, how can we securely deal with that, how can we control how long we can keep that data for, which has been a really good byproduct of that. So weāve been really, really impressed with that, and also, it makes us more compliant to the forensic science regulator codes, which weāre governed by within the UK. So where theyāre saying you must have an offline/off-site backup, weāve been able to do that with Azure by hosting that data off site in a secure environment.ā
Price reflected on the complexities of managing on-prem storage in the past āitās a lot of pressure, and it takes us away from our day job of being police officers, police staff and investigators doing digital forensicsā¦ And even what we do finally, you can have more server storage, but then itās the associated have we got the physical racking space available in the server room? Have we got all that power? Have we got that air conditioning? So all those hidden costs.ā
āSo, the benefits for us [of hosting data within Azure], within our digital forensics unit, has been that scalability of flexing that processing power on demand, the ability to scale up our storage within a very short period of time.ā
Questions around appropriate storage of data have been carefully considered and evaluated during this process. Price elaborated āI think one of the big things at the moment around police and in the cloud, is that ethical question of can we store data in the cloud? The process for us was before we done this, we took it to our legal services. They fully went through, can we do this? We then thought, right, we know legally we can do it, that ethical question is it the right thing to do? And I think itās a really good question, really.ā
āSo, the issue for us is, do we just stay static and keep trying to buy more and more on-prem servers, more and more on-prem storage or do we look at a more positive way of saying, right, letās try and deal with this more effectively, by scaling that process in a way to enable us to get through that data quicker?ā
Price added, āSo, we went through that legal journey with getting the sign offs. And it makes me feel comfortable with the fact of weāre holding true to our beliefs, our values, and the fact of we are massively trying to make a difference.ā
Evolution, inspiration, and staying up to date
āFor us, itās always about continuous improvement. And that continuous improvement doesnāt just mean spending money to purchase more systems or more services. It can be your own internal working practices that you tweak, for example. We encourage our staff to regularly present to the rest of the team around up and coming technologies. And weāre finding that works quite well, because then we create small subject matter experts who can understand those new technologies coming in.ā
āOne thing weāre always doing is, weāre one of the leading forces in the UK around cloud use, for policing at the moment in the digital forensics world. But that doesnāt mean we can just stop and be static. Itās always looking to our left, always looking to our right, what are others doing, whatās good practice, what can we take away? Not just, you know, nationally, looking internationally around whatās sort of coming through and where can we do that?ā
Price concluded, āFor the UK, most police forces that come to us and asked us for detail, weāve been quite accommodating and shared what weāve done with it. And the reason being is, if weāve gone through that original bit of work to deliver that, it doesnāt make any sense in another 43 other forces trying to replicate that, whatever those services are. So, weāve shared a lot of our documents around how we got there, because we think thatās really quite key.ā
To find out more:
About the Center of Expertise
Microsoftās Public Sector Center of Expertise brings together thought leadership and research relating to digital transformation in the public sector. The Center of Expertise highlights the efforts and success stories of public servants around the globe, while fostering a community of decision makers with a variety of resources from podcasts and webinars to white papers and new research. Join us as we discover and share the learnings and achievements of public sector communities.
Questions or suggestions?