Making the Case: How to Win Command Staff Support for Digital Forensics

Every digital forensics unit eventually has to make its case to the people who control the budget. Asking for another license or another examiner rarely works on its own. What works is showing command staff the risk they carry today, what changes when the capability is built in-house, and how the investment pays for itself in solved cases.

I have spent the last twelve years in mobile forensics and now sit on the command side of the table, overseeing the unit I used to work in. I have made this pitch, and I have also been the person hearing it. This article is the framework I use, organized the way I would present it in a briefing.

1. Start with the risk, not the wish list

Decision makers respond to risk. Before you talk about tools, help them see how much of the agency's caseload already runs through digital evidence, and what happens when it is handled the way we've always done it.

The volume is no longer optional

Phones are no longer a specialty. They are in almost every case. Cellebrite's 2026 Industry Trends report, which surveyed about 1,200 practitioners in 63 countries, found:

• 97% named smartphones as their top source of digital evidence, up from 73% in 2024.
• A typical investigation involves two to five devices.
• 56% of devices arrive locked.
• 94% said digital evidence has become more complex.
• 68% said review time is their biggest challenge.

The same report found that 95% of respondents agree digital evidence makes cases more solvable. Only 62% of agency leaders said they are shifting resources from legacy methods to digital ones. That gap between what the evidence demands and where the budget goes is exactly the conversation you need to have.

Push-button forensics is a liability

Forensic tools are essential, but they interpret data, and interpretations can be wrong. An examiner with minimal training can produce a report. Only a trained examiner can tell you whether that report is right.

The Karen Read case in Massachusetts showed the whole country how much can hang on a single artifact. A key witness's phone held a Google search, "hos long to die in cold." Some tool output associated it with 2:27 a.m., hours before John O'Keefe's body was found. The defense built much of its theory around that timestamp. Digital forensic experts later testified that the 2:27 time belonged to the browser tab, not the search, and that the search itself happened after 6 a.m. The vendor eventually removed that timestamp from its search data to avoid confusion.

Read was acquitted of second-degree murder in June 2025 after two trials. Whatever your view of the case, the lesson for every agency is the same. When a timestamp is reported without being understood, it can become the center of a case, a news cycle, and a public debate about your investigators' integrity.

It is not a new problem. In the 2011 Casey Anthony trial, jurors heard that someone had searched for "chloroform" 84 times. The developer of the software used to support that figure later said the term had been searched once. In both cases, the data was there. What mattered was whether someone with the training to interpret it correctly was looking.

Under-investing in digital forensics doesn't save money. It moves the cost into wrongful arrests, missed suspects, suppressed evidence, and lost public trust. We are not in the business of “forensically guessing.”

Put the liability in their language

When I brief command staff, I translate technical risk into the risks they already manage:

• Wrongful arrest or prosecution. A misinterpreted timestamp, location artifact, or “deleted” message can point at the wrong person. That carries civil liability, and the harm cannot be undone. We owe it to every stakeholder involved to get it right, the first time.
• The real suspect stays free. Every misdirected investigation is time the actual offender is not being pursued.
• Suppression and impeachment. Evidence collected outside the scope of legal authority, or handled without documented, validated methods, can be excluded. An examiner who cannot explain how a tool reached a conclusion can be taken apart on cross-examination.
• Reputational damage. One public failure can cost the agency credibility with prosecutors, judges, juries, and the community, and that is slow to earn back.

Getting it right cuts both ways. Thorough, validated analysis does more than build cases. It protects the innocent. In one of our cases, a phone examination uncovered exculpatory evidence that helped get a person who had been charged with murder released from jail. That is not a failure of the investigation. It is the system working the way it should, and it only happens when an examiner has the training and the time to look at everything the device holds, not just what supports the current theory.

2. Show what in-house capability changes

Many agencies start where most units start: one part-time operator, a single tool, and a desk shared with another assignment. Anything difficult goes to a regional, state, or federal lab and waits in line behind everyone else's cases.

Those labs do important work, but they serve many agencies, and they set their own priorities. Many are not built for this work at all. The Bureau of Justice Statistics' most recent census of crime labs, published in December 2023, found that only 23% of publicly funded crime labs performed digital evidence analysis. Those labs were carrying a backlog of roughly 710,900 requests across all disciplines.

When your homicide phone waits weeks or months for an extraction, the investigation waits too.

Time is the real currency

In a violent crime investigation, the most valuable leads are the freshest ones. These include:

• Who the victim talked to last
• Where a device was at the time of the incident
• Which accounts need preservation requests before data rolls off

An in-house examiner can deliver that while investigators are still knocking on doors. An external lab often delivers it after the trail has gone cold.

Preservation can't wait

Speed matters for a second reason that many decision makers have never heard of: the phone itself is working against you.

Modern iPhones and Android devices use file-based encryption (FBE). After the owner unlocks a phone once, it stays in an After First Unlock (AFU) state. In that state, many of the keys protecting user data are still available, and far more evidence can be recovered. If the phone restarts, it returns to Before First Unlock (BFU). Most user data is then locked behind the passcode again.

Both platforms now force that restart on their own:

• iPhone. Beginning with iOS 18.1, an iPhone that has not been unlocked for 72 hours automatically reboots into BFU.
• Android. In 2025, Google added a similar auto-restart through Google Play services for phones that stay locked for three consecutive days.

That clock starts at the owner's last unlock, not when the phone is seized. By the time a device reaches the evidence room, some of that time may already be gone.

Seventy-two hours is not enough time to submit a request to an outside lab and wait your turn. It is enough time for an in-house unit, if the agency is ready. That means:

• Patrol and investigators trained to isolate devices and keep them powered
• Search warrants sought immediately
• An examiner who can begin preservation within hours

In some cases, that window is the difference between recovering the evidence and never seeing it at all.

Moving from that part-time model to a dedicated, fully equipped unit changes three things:

• Speed. Extractions and targeted analysis happen in hours or days instead of waiting in an outside queue.
• Collaboration. Examiners sit with the investigative units, understand the case, and know which questions matter. That makes the analysis faster and more relevant.
• Control. The agency sets its own priorities, chain of custody, documentation standards, and quality checks, and it owns the expertise that comes with them.

Rethink how evidence reaches the investigator

Speed in the lab means little if the results are slow to reach the people who need them. For years, our workflow at RCSD looked like this:

1. Generate a tool report, such as a UFDR or a portable case.
2. Compress it into a ZIP file and upload it to Axon.
3. Send the stakeholder a link.
4. The stakeholder downloads the file, unzips it, and loads it onto a workstation that was rarely built for the job.

Every step added time and a place for things to go wrong. Large extractions took hours to move and often choked on basic-spec computers. To keep up, we kept buying hard drives and faster PCs. That cost grew with every case and never really solved the problem.

We moved to a software-as-a-service review platform, Magnet Review, and it has proven far more effective and efficient in the long run. Examiners process the evidence once and publish it to a secure, centralized platform. Investigators, supervisors, and prosecutors review it through a web browser on any device with internet access. There are no downloads, no unzipping, and no hunting for a computer powerful enough to open the case.

The benefits go beyond convenience:

• Faster access. Investigators can start reviewing the data the same day it is processed, often while they are still in the field.
• Lower hardware costs. The heavy lifting happens on the platform, not on each investigator's desk, so the agency stops buying high-end workstations and stacks of drives just to view evidence.
• Better control. Access is granted and logged centrally, rather than copies of sensitive evidence sitting on drives and download folders across the agency.
• Better use of examiners. Examiners spend less time packaging and troubleshooting reports and more time on analysis and validation.

For decision makers, this is an easy story to follow. A predictable annual subscription replaced a growing, unpredictable hardware bill, and investigators got their evidence faster.

What it looks like in real time

A recent case shows how these pieces work together. Deputies attempted to stop a vehicle that fled, led them on a pursuit, and eventually crashed. The occupants ran from the wreck into a wooded area and opened fire on the deputies.

While the suspects were still on the run, investigators collected several phones from inside the wrecked vehicle. Search warrants were sought and issued. Our in-house examiners extracted the devices and quickly identified their owners, before the suspects were located. Investigators knew who they were looking for while the search was still under way.

The payoff continued into the interview room. As one suspect was interviewed, a group of investigators and members of the digital team watched the interview while working through his phone data on the review platform. When he denied having a gun, they did not have to wait weeks for a lab report to prove otherwise. They had already found photos on his phone of him holding a gun, taken that same day. The interviewing investigator was able to confront the lie on the spot.

That is a win for the case, and it only happens when trained examiners, in-house tools, and immediate access to the evidence are all in place at the same time. Had those phones gone into an outside lab's queue, the investigators would have identified the suspects later and walked into that interview without the evidence.

3. Bring numbers they can repeat

Command staff have to defend their budgets to someone else: a county council, a city manager, the public. Give them numbers they can repeat in one sentence.

What it has meant for us: three years of 100% homicide solvability

The Richland County Sheriff's Department has solved every homicide in its jurisdiction for three straight years, beginning in 2023. For comparison, the FBI's national murder clearance rate was 61.4% in 2024. That was a meaningful improvement from a low of 49.4% in 2021, and it still means roughly four in ten murders nationally go unsolved.

As Who's On The Move reported, our in-house digital forensics unit has been a direct contributor to that record. The unit processes roughly 20 to 25 phones a week. Its work supports homicides and also missing-person, burglary, and financial crime investigations.

That did not happen because we bought a tool. It happened because we built a capability: trained, certified examiners working alongside the investigators, with the equipment to get into devices quickly and the discipline to validate what they find.

In homicide investigations, that capability has repeatedly:

• Put a suspect's name in front of investigators within the first days of a case
• Placed a device, and the person carrying it, at or away from a scene
• Confirmed or dismantled an alibi
• Given a victim's family answers sooner

South Carolina saw the same thing on a national stage. In the Alex Murdaugh trial, there was little direct evidence tying him to the scene. Then investigators recovered a video Paul Murdaugh recorded at the family's dog kennels at 8:44 p.m., minutes before he and his mother were killed. Alex Murdaugh had told investigators he was not at the kennels, but his voice is on that recording. Prosecutors paired the video with phone and vehicle data to dismantle his alibi. The state's attorney general credited the video for the jury's quick verdict. One file on one phone, found and explained by people who knew where to look, helped decide one of the most closely watched trials in South Carolina history.

Digital forensics does not solve cases alone. Investigators, patrol deputies, crime scene technicians, and prosecutors all play a part. But when command staff ask what the unit is worth, three years without an unsolved homicide is the answer. As I put it in that interview, criminals will lie, but the data does not.

The same capability shows up in the courtroom. I have testified as an expert in mobile and digital forensics numerous times, almost entirely in homicide and other violent crime investigations. Credible testimony from a trained, certified, well-documented examiner is what turns data into a conviction that survives a defense challenge and an appeal.

Track your own metrics

If you do not have numbers yet, start collecting them now. These are the ones that resonate with decision makers:

• Devices processed per month, and the trend over time
• Requests by division and case type, such as major crimes, special victims, property crimes, and narcotics
• Average turnaround, in-house versus outside labs
• Cases where digital evidence identified a suspect, corroborated a statement, or cleared someone
• Clearance rates for the case types the unit supports
• Court testimony given, and challenges to the evidence that were defeated
• Outside lab or vendor costs avoided

You cannot report numbers you never captured. That is why a lab case management system matters as much as any extraction tool. We use xBit, from Teel Technologies. It logs every request, device, and exam, and it can be customized to match how an individual agency is organized and how its lab actually works.

Because every request is tagged by division and case type, I can show command staff exactly how many devices major crimes, special victims, property crimes, and every other unit submitted for extraction and analysis. I can also show how long each one took and how that demand has grown. When a division commander asks why their phones are waiting, or a budget office asks who the unit really serves, the answer is a report rather than an estimate. That data is also what justifies the next examiner position.

Pair every number with a short, appropriate case example. One sentence about a family that got answers sooner will stay with a decision maker longer than a chart.

4. Give them a roadmap, not a shopping list

A request for "more tools" sounds like an expense. A phased plan sounds like leadership. Show command staff how the investment builds over time and how it will be sustained.

Phase the investment

1. People first. Dedicate at least one full-time examiner who is not pulled back to patrol or other assignments. Tools without trained people are the push-button problem with a bigger price tag.
2. Training and certification. Fund vendor training and vendor-neutral certifications that hold up in court. Budget for continuing education every year, because the platforms change every year.
3. Industry-standard tools. Acquire the hardware and software for extraction and analysis. Include more than one analysis tool so findings can be cross-validated. Use well-maintained open-source parsers for verification.
4. Lab infrastructure and quality. Build a secure workspace, evidence storage, test devices for validation, written procedures, and peer review before reports go out. Add a case management system that tracks every request by division and case type.
5. Evidence delivery. Plan how results reach investigators. A browser-based review platform can replace the cycle of exporting reports, shipping drives, and upgrading workstations.

Budget for the recurring costs

The most common mistake I see is funding a unit with a one-time grant and nothing behind it. Licenses renew every year. Training must be repeated. Hardware ages out. Build these into the operating budget as recurring line items, along with any review platform subscription. Treat grants as accelerators, not the foundation.

Retention belongs in that budget too. A trained mobile examiner takes years to develop and is easy to recruit away. Private industry, consulting firms, and federal agencies are all hiring the same people you just spent years training. Career paths, specialty recognition, and attention to wellness, especially for examiners exposed to traumatic content, protect the investment you have already made.

Position the agency for what is next

The next challenges are already here: vehicle infotainment and telematics data, cloud and warrant returns, connected devices, encrypted apps, and AI-assisted review. An agency with trained people and a sustainable budget can adapt to each of them. An agency that bought a single tool five years ago will be starting over every time.

The goal is a unit that is self-sustaining, legally defensible, and ready for the evidence it has not seen yet.

The briefing

When you get your meeting to make the case, this is the structure I recommend:

Your tools don't testify. You do. The case for investing in digital forensics is ultimately a case for investing in the people who stand behind the evidence.

The views in this article are my own and do not necessarily represent the Richland County Sheriff's Department.

Sources

• Cellebrite, 2026 Digital Forensics Industry Trends
• Bureau of Justice Statistics, Publicly Funded Forensic Crime Laboratories, 2020 (published December 2023)
• Center for American Progress, Nationwide 2024 crime data (FBI clearance figures)
• Boston 25 News, "Hos long to die in cold": digital forensics expert analyzes when McCabe made Google search, 2025
• Anchorage Daily News / AP, Karen Read found not guilty of second-degree murder, June 2025
• ABC News, How Paul Murdaugh helped solve his own murder, 2023
• ABA Journal, Expert: I warned prosecutors Casey Anthony didn't do 84 "chloroform" searches, 2011
• TechCrunch, New Apple security feature reboots iPhones after 3 days, researchers confirm, 2024
• 9to5Google, Android auto-restart security feature, 2025
• Magnet Forensics, Magnet Review
• Teel Technologies, xBit digital case management
• Who's On The Move, Digital forensics: a crime-solving game-changer, 2026