Addressing the Digital Forensic Challenges Within Modern Law Enforcement

(1)

STOCKHOLM SWEDEN 2020,

Addressing the Digital Forensic Challenges Within Modern Law Enforcement

A study of digital forensics and organizational buying behavior from a DF-company perspective

JOHAN BRANDT OSCAR WÄRNLING

KTH ROYAL INSTITUTE OF TECHNOLOGY

SCHOOL OF INDUSTRIAL ENGINEERING AND MANAGEMENT

(2)

Challenges Within Modern Law Enforcement

A study of digital forensics and organizational buying behavior from the perspective of a digital forensics company

by

J ^OHAN B ^RANDT O SCAR W ÄRNLING

M

ASTER OF

S

CIENCE

T

HESIS

TRITA-ITM-EX 2020:332 KTH I

NDUSTRIAL

E

NGINEERING AND

M

ANAGEMENT

I

NDUSTRIAL MANAGEMENT

SE-100 44 STOCKHOLM

(3)

Utmaningar Inom Modern Brottsutredning

En studie om digital forensik och organisatoriskt köpbeteende utifrån ett digital forensik-företags perspektiv

by

J ^OHAN B ^RANDT O ^SCAR W ^ÄRNLING

E

XAMENSARBETE

TRITA-ITM-EX 2020:332 KTH I

NDUSTRIELL

T

EKNIK OCH

M

ANAGEMENT

I

NDUSTRIELL

E

KONOMI OCH

O

RGANISATION

SE-100 44 STOCKHOLM

(4)

A BSTRACT

Today’s law enforcement agencies are presented with challenges regarding how to navigate the rapidly changing technical landscape. The proliferation of digital devices in society has presented opportunities for modern criminals, result- ing in substantial changes in criminal behavior. Digital devices have, thus, become a crucial piece of evidence within forensic investigation processes, which has caused the field of digital forensics to emerge as a central part of modern law enforcement. However, law enforcement is experiencing substantial challenges in regard to handling the complexity of modern digital devices, as well as the data quantities that these devices imply.

While digital forensics literature commonly discusses the challenges that law enforcement agencies are facing, it fails to address the role and responsibilities that the digital forensic companies have in ensuring that law enforcement agencies possess the necessary means to counteract criminal activity. Therefore, this study aims to investigate how the companies that supply the tools that law enforcement depends on, can help the agencies to overcome these challenges. Although the need for digital forensics is at an all time high, the consensus among practitioners is that they lack the necessary means to adequately handle digital evidence.

Moreover, it is identified that lack of organizational understanding is impeding law enforcement from prioritizing allocation of capital towards digital forensics.

Thus, this study also assesses how digital forensic companies can adapt their marketing approaches based on the purchasing behavior of law enforcement, in order to efficiently communicate the need within the customer organizations and ensure that law enforcement agencies possess the necessary means to counteract modern criminality.

In order to investigate this area of research and address the identified problems,

(5)

the study is set up as a case study in collaboration with a European digital forensic company. The study includes several internal interviews with company rep- resentatives, as well as a large amount of external interviews with digital forensic experts from different European law enforcement agencies. The empirical evidence is assessed against renowned literature within digital forensics and organizational buying behavior to acquire a comprehensive understanding of the problems and help answer the proposed research questions.

The study concludes that the main challenges that law enforcement is facing in regard to digital forensics originate from a lack of organizational understanding.

This results in insufficient resources being allocated towards digital forensics. In turn, this limits law enforcement’s ability to properly educate their staff and purchase the necessary tools to effectively handle the complexity and quantity of evidence that modern digital forensics implies. To address this, digital forensic companies are required to adapt their business models to the resource limitations of their customers by offering more flexible training solutions and tailor the tools based on specific user needs. Moreover, it is determined that companies should be involved in pursuing law enforcement management to improve the organizational understanding regarding the importance of digital forensics.

The study also identifies that the organizational structure of law enforcement agencies highly impact their purchasing behavior. Depending on the degree of law enforcement centralization, the buying center structure varies. For centralized organizations the scale of the buying center is generally larger and the same applies for its purchases. The individual members of the buying center have minor influence over the decision making process, instead the decisions are a consequence of collective decision making by different departments. In contrast, decentralized organizations make smaller purchases through smaller buying centers. The individual members within the decentralized buying center have far more influence over the buying behaviour in comparison to the members of a centralized organization’s buying center. Therefore, digital forensic companies need to employ different marketing strategies to anchor their products within different law enforcement organizations. It is established that companies should aspire to identify the buying centers of potential and existing customer organizations, to improve efficiency of marketing efforts. Mapping out organizational and authori- tative structure is, thus, concluded to be crucial in order to successfully capitalize on the purchasing behavior of different law enforcement organizations. To enable digital forensic companies to practically apply these suggestions within the context of their marketing strategies, applicable models based on theory and em- pirics are proposed.

(6)

S AMMANFATTNING

Dagens brottsbekämpande myndigheter står inför en stor mängd utmaningar när det kommer till att navigera i det snabbföränderliga tekniska landskapet. Sprid- ningen av digitala enheter i samhället har presenterat möjligheter för kriminella, vilket har resulterat i väsentliga förändringar i kriminellt beteende. Digitala enheter har därför blivit viktiga som bevis inom moderna forensiska utredningspro- cesser, vilket har lett till att digital forensik har blivit en central del av modern brottsutredning. Brottsutredande myndigheter upplever dock betydande utmaningar när det kommer till att hantera komplexiteten hos moderna digitala enheter, samt den mängd data som dessa enheter medför.

Litteratur om digital forensik tar frekvent upp utmaningarna som brottsbekäm- pande myndigheter står inför. Däremot tar litteraturen inte upp rollen och ansvaret som digital forensik-företagen har i att säkra att brottsutredande myndigheter har de nödvändiga verktygen för att bekämpa brottslighet. Därför är syftet med studien att undersöka hur företagen som förser brottsutredande myndigheter med verktyg, kan hjälpa till att lösa dessa problem. Trots att behovet av digital forensik är rekordhögt, är konsensusen bland utövare att de saknar de nödvändiga medlen för att hantera digitalt bevismaterial. Dessutom identifieras det att organisatorisk förståelse hindrar brottsutredande myndigheter från att prioritera allokering av kapital för digital forensik. Därmed undersöker denna studie också hur digital forensik-företag kan anpassa sina marknadsföringsstrategier baserat på brottsutredande myndigheters inköpsbeteende, för att effektivt kunna kom- municera behovet inom kundorganisationerna och försäkra att brottsutredande myndigheter innehar de nödvändiga medlen för att kunna bekämpa kriminalitet.

För att undersöka detta forskningsområde och hantera de identifierade problemen, är studien strukturerad som en fallstudie i samarbete med ett Europeiskt digital forensik-företag. Studien inkluderar ett mindre antal interna intervjuer

(7)

med företagsrepresentanter, samt ett flertal externa intervjuer med digital forensik- experter från olika brottsutredande myndigheter i Europa. Det empiriska un- derlaget analyseras med hjälp av erkänd litteratur inom digital forensik samt ramverk inom organisationellt köpbeteende för att få en omfattande förståelse för problemen och kunna besvara de föreslagna forskningsfrågorna.

Studien drar slutsatsen att de mest omfattande utmaningarna som brottsutredande myndigheter står inför när det gäller digital kriminalteknik, grundas i brist på organisatorisk förståelse. Detta resulterar i att de resurser som allokeras till digital brottsbekämpning är otillräckliga. I sin tur begränsar detta brottsutredande myndigheters möjligheter att i tillräcklig utsträckning utbilda personal samt an- skaffa de nödvändiga verktygen för att effektivt hantera komplexiteten och bevis- kvantiteten som dagens digitala brottsbekämpning innebär. För att hantera detta krävs att digital forensik-företag anpassar sina affärsmodeller efter kundernas resursbegränsningar genom att erbjuda mer flexibla utbildningslösningar och verktyg som är skräddarsydda utifrån specifika användarbehov. Dessutom fast- ställs det att företagen bör vara involverade i att övertyga brottsutredande myndigheter på ledningsnivå om digital brottsbekämpnings betydelse och relevans.

Studien identifierar också organisatorisk struktur inom brottsutredande myndigheter som en faktor som har stor inverkan på inköpsbeteende. Beroende på graden av centralisering, så kommer “buying center”-strukturen att förän- dras. För centraliserade organisationer är både skalan av buying centret och inköpen stora. De individuella medlemmarna av buying centret har lite inflytande över beslutsprocessen, istället så är besluten en konsekvens av kollektiva beslut fattade av flertalet avdelningar. I kontrast till centraliserade organisationer så gör decentraliserade organisationer mindre inköp genom mindre buying centers. De individuella medlemmarna inom decentraliserade buying centers har betydligt mer inflytande över köpbeteendet i jämförelse med medlemmarna i en centraliserad organisations buying center. Därför behöver digital forensik- företag adoptera olika marknadsföringsstrategier för att lyckas nå ut och förankra produkterna inom brottutredingsorganisationer. Det fastställs att företag borde sträva efter att identifiera potentiella och befintliga kunders så kallade buying centers för att effektivisera marknadsföringsinsatserna. Kartläggning av organ- isatoriska och auktoritära strukturer är därför nödvändigt för att framgångsrikt kapitalisera på rättsutredande organisationers inköpsbeteenden. För att göra det möjligt för digital forensik-företag att praktiskt tillämpa dessa förslag på deras marknadsföringsstrategier, har applicerbara modeller baserade på teori och em- piri föreslagits.

(8)

Acknowledgements

We would like to extend our sincerest gratitude to all the people who made this thesis project possible. First of all, we would like to thank our supervisor Henrik Blomgren for mentoring us throughout the entire process and providing innova- tive ideas on how to approach our research. We would also like to thank Com- pany X for sponsoring this thesis project and for allocating time and resources towards our research during the collaboration. We would like to thank all the 19 interviewees for agreeing to be part of our study, and for contributing with their time, knowledge and experience, without you this research would not have been possible. Lastly, we would also like to thank our fellow KTH master thesis candidates for providing insightful feedback and aiding in improving the quality of our study.

Stockholm, June 2020 Oscar Wärnling & Johan Brandt

(9)

Introduction

The background that introduces the reader to the research context is included in this chapter. The background is followed by the problem formulation, research purpose and research questions that this study seeks to answer. Moreover, this chapter includes the delimitations, scientific contribution as well as a short introduction to the company sponsoring this thesis project.

1.1 Background

Smartphones and other forms of digital devices have become an important part of modern society. Although a vast majority of digital devices are harmlessly used for checking emails, browsing the internet, entertainment and simplifica- tion of other daily tasks, the global proliferation of digital devices has also facilitated criminal activity (Ali et al., 2017; Barmpatsalou, Cruz, Simoes & Monteiro, 2018a). The same devices that provide societal benefits, are also being used for planning, initiating, sustaining and recording criminal activity (McMillan, Glis- son& Bromby, 2013). Although mobile phones may be one of the most rapidly evolving types of digital devices, they are not the only type of device that have gone through a digital evolution. For example, modern-day vehicles, such as cars and drones store a large amount of data that can be examined to tie a vehicle to a crime (Le-Khac et al., 2018; Jain, Rogers & Matson, 2017). In order to investigate and counteract crime involving digital devices, law enforcement within police, military and other governmental organizations are forced to adopt digital solutions. The practice of assessing digital evidence is referred to as digital forensics (Garfinkel, 2010).

Digital forensics (DF), although being a rather new phenomenon within criminal investigation, is a crucial part of acquiring information about suspects and potential victims (Goodison, Davis & Jackson, 2015). Over 80 percent of court cases in recent years have involved some type of digital evidence, which has resulted in new challenges of how to process and assess forensic evidence (Anobah, Saleem

& Popov, 2014). Therefore, the need and demand for forensic tools that accurately extract and analyze digital evidence has accelerated (Ibid).

(13)

The widespread use of digital devices in society has resulted in a broad variety of digital forensic tools to emerge on the market over the last two decades (Benkhe- lifa et al., 2016). Different digital forensics tools are used within different stages of a digital forensics process. The digital forensics process can be categorized into an extraction stage and a data analysis stage, requiring separate tools and expertise (Ayers, Brothers & Jansen, 2014). A crucial problem that has emerged within digital forensics, is the fact that a majority of the emphasis has historically been put on the technical aspect associated with collection and extraction of forensic evidence from physical devices. The technology used for extracting data has, thus, far surpassed the technology for adequately analyzing evidence. The technological deficiencies of analytic tools, along with lacking education among users are the two most crucial aspects affecting the efficiency of digital forensic processes. The lack of analytical capability commonly results in failure to identify crucial evidence (Barmpatsalou et al., 2018b).

Moreover, the technological advances of primarily mobile phones, have also resulted in forensic investigators being overwhelmed with evidence volumes. Large evidence backlogs is, thus, a commonly encountered problem for law enforcement agencies globally (Homem, 2018). Despite the efforts of digital forensic experts, evidence backlogs of two years are not uncommon within law enforcement agencies (Scanlon, 2016). The volume of cases, coupled with the volume of data required to be processed per case, is forecasted to continue increasing in the fu- ture. Thus, the demand for tools to efficiently examine, analyze and assess digital evidence is at an alarming all time high (Rogers, 2016; Garfinkel, 2010; Scanlon, 2016).

Due to the technologically complex nature of the tools used to assess digital evidence, law enforcement agencies typically lack both resources and expertise to produce these tools. Thus, law enforcement is completely reliant on digital forensic companies that exclusively work on development of tools to aid in the digital forensic process. Consequently, digital forensic companies are able to capitalize on the situation. However, there are many actors within the market for digital forensic tools. The fierce competition makes it vital for these companies to establish an understanding of their custormer’s organizational structure to market themselves effectively. The theoretical field of organizational buying behavior can be used to describe the underlying structure within an organization that steers its purchasing behaviour. This description can be utilized to great effect by companies aiming to market themselves within any business area (Webster & Wind, 1972).

(14)

1.2 Problem Formulation

Law enforcement agencies all around the world are experiencing problems with the efficiency of their digital forensics processes, due to being unable to keep up with the recent surge in cases requiring digital forensic investigation as well as the volume of data required to be analyzed within each specific case (Scan- lon, 2016). These challenges are creating evidence backlogs, which affects law enforcements’ ability to effectively address criminal investigations. In turn, this inability to effectively process evidence impacts the efficiency of the entire legal system, as cases are unable to progress (Homem, 2018). Research suggests that the only realistic and sustainable solution to address the efficiency problem that law enforcement is facing is to adopt tools that can aid the processing of digital evidence (Garfinkel, 2010). However, the tools used for analysing evidence have failed to keep up with the technological advances in society and have failed to meet the increasing demand of law enforcement agencies (Barmpatsalou et al., 2018b). As a consequence of the increasing complexity of both the technology behind the devices as well as the tools used to assess the evidence, the knowledge required to effectively handle digital evidence has also increased (Homem, 2018).

A substantial amount of previous research discusses the challenges that law enforcement agencies are facing due to the changes in technology and behavioral patterns among modern criminals. Furthermore, it primarily focuses on how these problems can be dealt with from the perspective of the law enforcement organizations (Scanlon, 2016; James & Gladyshav, 2013; Homem, 2018). However, literature fails to address how digital forensic companies should respond to the challenges that their customers are facing and the changes in customer demand that these challenges imply. The literature field fails to provide clear directions regarding how the companies should strategize in response to the changes in customer needs, and how they can adapt their tools and services to facilitate the work of law enforcement agencies. Thus, there is a clear gap in literature of how these problems are to be addressed from the perspective of the companies that provide law enforcement with the necessary tools to perform the forensic investigations. These companies play a vital role in achieving a sustainable solution to the problems and the challenges that law enforcement agencies are facing, which is something that literature clearly fails to address.

In addition, limited previous research has been conducted addressing how the organizational structure of law enforcement agencies affect their ability to acquire the necessary digital forensic tools to effectively counteract criminal activity. Since no clear directions have been established regarding how the companies should strategize in response to the organizational structure and organizational purchasing behavior of law enforcement agencies, this is also something that this thesis aims to address.

(15)

1.3 Research Purpose

The purpose of this research study is to investigate how digital forensics companies can help address the identified problems that law enforcement agencies are facing as a consequence of the recent surge in demand for digital forensic investigations.

1.4 Research Questions

To be able to answer how digital forensics companies can help address the problems that law enforcement agencies are facing as a consequence of the recent surge in demand for digital forensic investigations, the following research questions are formulated:

RQ1: What are the organisational and technological challenges that law enforcement agencies are facing in regard to being able to effectively process digital evidence?

RQ2: How can digital forensics companies adapt their products/services to aid law en- forcement agencies to overcome these challenges?

RQ3: How does the organizational structure of law enforcement agencies affect their pur- chasing behavior?

RQ4: How can digital forensics companies capitalize on the organizational buying be- haviour of law enforcement agencies?

(16)

1.5 Scientific Contribution

To date, a number of studies have addressed the issues that law enforcement is facing in regard to the lack of efficiency related to analysis of digital evidence (Garfinkel, 2010; Rogers, 2016; Aldolah, Razak, Othman & Mohammed, 2018;

Scanlon, 2016; James & Gladyshev, 2013; Vincze, 2016). These studies primarily focus on assessing the issues from the perspective of law enforcement agencies and how these can strategize against the challenges that the recent surge of digital evidence has implied. However, literature fails to provide concrete solutions to how these challenges are to be addressed from the perspective of the companies that provide the tools used for performing the investigations. Consequently, this study adopts a gap-filling approach (Blomkvist & Hallin, 2015). Anchored on a single case study, this thesis aspires to fill this gap in literature and contribute to the scientific research fields of digital forensics, as well as organizational buying behavior. This is done by identifying the major challenges that law enforcement is facing regarding digital forensics, and by providing concrete solutions to how digital forensic companies can help address these issues. The study also aims to contribute to the field of digital forensics by applying organizational buying behavior within a digital forensics context. This is necessary in order to accurately acquire an understanding of how organizational structure and purchasing behavior is affecting law enforcement’s ability to effectively address criminal activity.

1.6 Delimitations

In order to carry out an achievable study and produce useful results within the set timeframe of five months, certain delimitations were required. Firstly, the research was delimited to investigate the situation related to the European market, with Sweden, Norway and Great Britain being the main focal countries. These limitations were adopted primarily due to time constraints as well as thesis sponsor desires. Furthermore, the research conducted in this thesis will primarily focus on the process and the tools associated with analysis of digital evidence. Since the thesis is based on a single case study, the findings and conclusions drawn are specifically tailored towards the case company and may not be applicable in other contexts.

Digital forensic tools are rapidly evolving in parallel to the needs of the users. To increase the accuracy of this research, the report will focus on the problems that law enforcement agencies are facing in the year 2020 and potential solutions that could come to be implemented over the next decade.

Law enforcement agencies can vary a great deal in the way that they operate.

However, these agencies all serve the same purpose to some regard, namely, to enforce law. In the private sector, the use of forensic tools could be used in a plethora of different cases. Therefore, this research will strictly focus on law enforcement agencies.

(17)

Lastly, digital forensics generally involves a large variety of devices, where certain types of devices are developing more rapidly than others. This thesis will focus on rapidly evolving devices that pose new challenges for law enforcement agencies, such as mobile phones and vehicles.

1.7 Thesis Sponsor

The sponsor of this master thesis is a company that provides technological solutions within digital forensics. The company will due to confidentiality reasons, henceforth, be referenced to as Company X. Company X is per definition a small/medium-sized enterprise (Wapshott & Mallett, 2018), with operations across different continents. They operate primarily in a business-to-government environment, with clients mainly being comprised of governmental organizations that work within national security, such as police, military and customs.

Company X develops, markets and sells digital forensic products and services to enable its clients to conduct scientifically sound forensic investigation processes of digital devices.

(18)

Chapter 2

Literature Study

This following section aims to thoroughly describe the concept of digital forensics, along with previous research and literature related to the topic. Furthermore, theory and previous research within organisational buying behavior and buying centres are also covered in this section.

2.1 Introduction to Digital Forensics

Digital forensics developed into an independent research field in the late 1990s and early 2000s, as cyber crimes became commonplace (Raghavan, 2013). How- ever, the technological advancements since the early 2000s have resulted in several new types of devices that facilitate criminal activity. Thus, the process of con- ducting forensic investigations involving contemporary digital devices implies new and changing challenges, as technology keeps on advancing (Ibid). With the proliferation of digital devices in society, the traces produced by using these devices have become a critical part of modern forensic investigation processes (Baar, Beek & Van Eijk). The number of cases requiring digital forensic analysis has been increasing significantly during the last decade (Scanlon, 2016). As of 2014, more than 80 percent of all court cases in the United States involved some type of digital evidence, which emphasizes the importance of possessing the adequate tools and knowledge for accurately assessing digital evidence (Anobah, Saleem & Popov, 2014).

Digital forensics refers to legally and scientifically sound techniques for collect- ing, preserving, analysing and validating digital evidence, which is a crucial aspect of successful law enforcement (Choo & Dehghantanha, 2017; Beebe, 2009;

Benkhelifa et al., 2016; Barmpatsalou, Cruz, Simoes & Monteiro, 2018a). Digi- tal forensics assesses criminal behavior that either uses, targets or is facilitated by technology (Rogers, 2003). The objective of DF-procedures is to facilitate the work of forensic specialists, by aiding in investigating, reconstructing and document- ing events associated with a suspected crime (Barmpatsalou et al., 2018a).

(19)

2.1.1 The Digital Forensic Process

The process of a digital forensics investigation always differs depending on the specific case. However, there are some standardized stages which a majority of digital forensics investigations follow, see figure 2.1 (Ayers et al., 2014). For digital evidence to be able to hold up in a legal environment, the scientific soundness of the four stages needs to be guaranteed (Garfinkel, 2010). Therefore, each stage is a vital part of being able to ensure a scientifically and legally acceptable forensic investigation process (Ayers et al., 2014).

FIGURE2.1: The mobile forensics Investigation Process model, extended from (Ayers et al., 2014).

Preservation

The first step of the four stage process is the preservation stage. Preservation refers to the process where identified evidence is seized from a crime scene. It involves search, recognition, documentation, collection and transporting of physical electronic evidence. This is commonly done by the forensic investigator in charge of the case (Ayers et al., 2014). A fundamental requirement of evidence preservation is that evidence is seized without altering, changing or damaging the data residing on the digital device (Abdelsalam, 2010). In order to use evidence in court of law or any other legal proceeding, it must have been handled correctly throughout the entire forensic investigation process, which includes preservation. The preservation stage is crucial, as failing to accurately preserve evidence in its original state may jeopardize the entire investigation. Thus, a proper evidence preservation stage is a requirement to be able to successfully conduct a digital forensic investigation (Ayers et al., 2014).

Acquisition

The preservation stage is followed by an acquisition stage, which is the process of extracting and acquiring data from the preserved digital device. Acquisition aims to obtain the data present within a digital device, which can be encrypted, deleted or generally hard to locate. Thus, a digital forensics tool that can crack passwords, bypass encryption and recover deleted data from the memory of a device is generally required to perform an effective data acquisition process (Ayers et al., 2014).

The type and model of the digital device dictates which tools and techniques that are required to perform the specific acquisition process (Ibid). For example, acquiring data from a mobile phone is a lot more complex than extracting data from the hard drive of a computer (Mahalik, Tamma & Bommisetty, 2016).

(20)

Certain mobile phone models require different extraction approaches. Thus, successfully identifying the type of model on which the extraction will be performed is a crucial aspect of the acquisition stage (Abdelsalam, 2010).

Data acquisition is usually performed in a laboratory by a forensic examiner, since a substantial amount of prior analysis is required to establish which forensic tool to use for creating a forensic copy of the content of the specific device. In certain cases, extraction can be performed at the actual crime scene to avoid loss of information due to battery depletion or damage during transportation. How- ever, off-site acquisitions are generally challenging due to equipment restrictions (Ibid).

Analysis

The third stage of the process is referred to as the analysis stage. It involves analyzing successfully extracted evidence from a digital device. The acquisition stage generates and assembles large amounts of raw data, which needs to be assessed and analyzed in order to conclude whether the evidence can tie a suspect to a crime (Ayers et al., 2014). The forensically extracted data is dissected and recon- structed in order to be able to pinpoint relevant evidence and identify correlation of events (Homem, 2018).

Within the digital forensics process, the analysis stage is by far the most time consuming as it often requires large amounts of data to be assessed (Brenner, 2012). There is also a greater need for human involvement in the analysis stage compared to the acquisition stage, as analysis requires prior knowledge about the context of a case. The forensic expert performing the analysis needs to know what to look for to be able to effectively analyze the data (Ayers et al., 2014).

Traditionally, the forensic examiners working in the forensic laboratories have been the ones doing both the extractions as well as the analysis, with the help of forensic analysts. However, due to the increase in cases and evidence volumes, the examiners and analysts barely have the time or resources to assess all the devices. Thus, further pressure is being put on the forensic investigators to not only be in charge of the cases, but also help to analyze all the digital evidence that the respective cases generate. The involvement of the forensic investigators in the analysis process is also deemed beneficial, since the investigators have a superior understanding of the case (Scanlon, 2016).

Since a digital forensics investigation usually requires a large amount of data to be analyzed, using a specific tool to help organize and categorize the raw data is a necessity. Due to the prevalence of proprietary file formats, the forensic tools used for acquisition are typically the ones used for analyzing the extracted data.

Using third party tools is possible, but can prove unnecessarily challenging as it may require altering the data (Ayers et al., 2014).

(21)

Reporting

Reporting is the process of summarizing the actions taken and conclusions reached within the frame of an investigation. In order to end up with an accurate and reliable report, it is crucial to maintain records of all prior forensic stages. A solid report is dependent on having a solid documentation, notes, photos and tool- generated content (Ayers et al., 2014).

Reporting occurs after all the data has been thoroughly analyzed and all relevant findings have been recorded. It is common for modern DF-tools to have their own reporting functionality, with predefined report structures and templates.

The software-generated content is a crucial part of the final report, which also includes physical evidence, interrogation records and other relevant data accu- mulated throughout the case. This report is consequently used by the prosecutor in court of law to be able to convict a suspect (Ibid).

2.1.2 Digital Forensics Subcategories

As previously mentioned, the original focus of digital forensics was in cases where computers were used in the perpetration of a crime. However, due to technological advancements, the field has expanded to include a large variety of devices that store digital information and can be used in criminal activities (Kohn et al., 2013; Raghavan, 2012).

Digital forensics covers a large variety of different areas that require further clas- sification. These subcategories include computer forensics, network forensics, audio/video forensics, database forensics, vehicle forensics and mobile forensics.

Despite the similarities between the different subcategories, the forensic evidence has to be handled differently depending on the category. Thus, it is impossible for a forensic investigator to be an expert in all areas (Barmpatsalou et al., 2018a).

Mobile Forensics

The most rapidly increasing sub-category within digital forensics is by far mobile forensics, as mobile phones have become the most common means of communication among criminals (Ferrara et al., 2014). Mobile forensics (MF) refers to the process of assessing digital evidence from mobile devices under forensically sound conditions (Baror & Venter, 2013). The increase in mobile devices on a global basis, has facilitated criminal activities such as sales of drugs, child pornography, fraud and terrorism (Ali et al., 2017). The instant communication that mobile phones offer is oftentimes used by criminals to avoid physical in- teractions which would increase the risk of being identified and arrested (Barm- patsalou et al., 2018b). However, when a mobile phone is seized by police, the information contained within the device can be used as evidence to help convict a guilty suspect. Mobile devices are more likely to reveal details about a user’s behavior and habits than any other type of digital device, which is why

(22)

mobile forensics can be crucial within crime investigation (Barmpatsalou et al., 2018a).

Historically, the only relevant information within a mobile phone was recent calls and messages sent via SMS. However, as mobile phones have developed, the volume of data stored within a single device has ballooned (Scanlon, 2016). Today, mobile phones store a wide range of different information that could serve as evidence in an investigation. However, the police are also faced with new challenges as phones develop. Different phones require different methods for collect- ing data. As new mobile phone models enter the market, the complexity of the process increases.

Vehicle Forensics

Although mobile phones and desktop computers are the most common areas of use within digital forensics, DF has also proven to be useful in other more nichéd technological fields. The automobile industry has been evolving and, in that process, has started to incorporate technologies that allow digital forensics to with- draw data in case of a suspected crime involving cars. Modern-day cars store a wealth of information that could be used to tie a car to a crime, such as destina- tions and popular routes (Le-Khac et al., 2018). This gives police more evidence to prove a case, as they can tie a car to the scene of a crime. For a criminal, cars are essential tools for many types of crimes and DF makes them more vulnerable to investigation (Ibid).

Another type of vehicles that are commonly come across in criminal activity are unmanned aerial vehicles (UAV’s) or drones, which have existed for quite a few years. However, these types of vehicles have recently seen a surge in availabil- ity. Today, drones are available to any consumer at a relatively affordable price.

Therefore, the market for drones has been growing at a rapid rate in recent years (Jain et al., 2017). Drones can be used in a plentitude of ways, but are commonly used to film aerial videos. However, these drones can also be used with ma- licious intent. Smuggling and voyeurism are examples of commonly committed UAV crimes. UAVs enable crime to be committed without the criminal needing to be present at the scene of the crime. Thus, the individual piloting the drone can be nearly impossible to locate considering the facts that even consumer drones can travel large distances from the pilot and follow predetermined paths (Hors- man, 2016). Certain branches of DF have specialised in crimes involving drones by intercepting the communication between the drone and its pilot as well as analysing the internal memory of the drone(Ibid).

2.1.3 Digital Forensic Tools

In order to effectively investigate digital evidence, having the adequate tools is crucial. Within the four stages of a digital forensic process, digital forensics tools are generally adopted to help forensic investigators within the extraction stage (Acquisition) and the data analysis stage (Examination/Analysis). The extraction

(23)

stage of the process refers to the part where the encrypted data is extracted from the device. With the large amounts of data stored within modern digital devices, this process usually results in massive amounts of extracted raw data. Therefore, it is near impossible for a forensic investigator to effectively review, analyze and locate the desired evidence without the use of a forensic analysis tool (Rogers, 2016; Barmpatsalou et al., 2018a). These data analysis tools enable analysis of the extracted data, and summarize the evidence into presentable documents that can be used in a court of law (Raghavan, 2012).

Historically, the big challenge within digital forensics has been to break into devices and successfully extract the desired data, which has resulted in digital forensic tool developers almost exclusively putting their efforts into developing pow- erful tools to extract data from devices. Consequently, the available tools for extracting data have become far more developed and widely adopted among law enforcement compared to the existing tools for analyzing the extracted data. In contrast to extraction, mobile forensic data analysis is one of the most underde- veloped subdisciplines within digital forensic tools. However, achieving an effective forensic investigation requires both technological aspects to be successfully incorporated into the process (Barmpatsalou et al., 2018b).

Forensic examiners frequently fail to acquire desired data in a forensically sound manner, causing crucial evidence to be routinely missed (Garfinkel, 2010). This is further supported by Rogers (2016), who claims that the deficiency of the analytical technology commonly results in failure to successfully identify evidence.

Moreover, the technological advances have also resulted in forensic investigators being overwhelmed with volume of extracted evidence, without possessing the means to effectively analyze the data. Thus, the demand for tools to efficiently examine, analyze and assess the acquired data is high (Rogers, 2016).

Beebe (2009) argues that it is crucial to ensure that the technological needs and requirements regarding forensic tools are communicated to digital forensic tool developers, so that forensic practitioners possess the necessary means to effectively investigate crime.

Furthermore, organizations commonly encounter problems within analysis of forensic data, where lack of necessary forensic training among investigators results in unsuccessful data analysis. Even data that is easily analyzable often has to wait for months before being properly analyzed due to data management issues, which can be devastating for the effectiveness of a criminal investigation (Garfinkel, 2010).

According to Beebe (2009), it is crucial that tools are not too technologically ad- vanced and that the user interfaces are intuitive and easily understood, while still being customizable for experienced forensic practitioners. Beebe also argues that technical complexity is a major issue within forensics tools, and that they usually are designed for expert use.

(24)

2.1.4 Digital Forensics Challenges Within Law Enforcement

With the increase of digital devices involved in criminal activity, the need for digital forensic investigations has escalated. Law enforcement agencies all around the world have experienced difficulties addressing the recent surge in demand for digital forensic solutions. Although law enforcement agencies are aware of the challenges they are facing, they are struggling to address them (Scanlon, 2016).

According to Harkin, Wheelan & Chang (2018), there are three major issues that have emerged within assessing digital evidence: the accelerating quantity of workload as a consequence of the proliferation of digital devices in society, the lack of resources available to address the workload and the absence of required knowledge and training within law enforcement units.

Moreover, the upsurge of machine learning has enabled certain processes of digital forensics to become automated. This progress has resulted in debate regarding its adequacy as a replacement to traditional evidence analysis. Especially since the control of sensitive information is put in the hands of a computer (Garfinkel, 2010; Homem, 2018; James & Gladyshav, 2013; Flandrin et al., 2014).

Ensuring that reliability, accuracy and verifiability is not compromised is an essential aspect of the digital forensics process. Thus, ensuring a balance between retrieving key evidence and invading user privacy is a big challenge. Due to increase in storage capacity of devices, digital investigation processes gather large amounts of information. Only a small amount of this data is going to be relevant for the investigation, with a large majority being outside the scope. Therefore, there is an argument to be made for such methods invading individual privacy rights, as sensitive information about suspects or victims may be gathered that has nothing to do with the case itself (Hong, Yu, Lee & Lee, 2013).

The Digital Forensics Backlog Problem

The increasing complexity of digital forensic investigations has resulted in what is commonly referred to as digital forensic backlog problem, which is becoming a significant problem among law enforcement agencies (Homem, 2018; Scanlon, 2016). The digital evidence backlog is primarily caused by the increase in sheer volume of evidence data that needs to be processed within modern forensic cases (Scanlon, 2016). Moreover, Vincze (2016) also addresses the challenges surround- ing increasing data volumes compared to law enforcement and legal systems’

abilities to keep up. During the last couple of decades there has been rapid advancements in device’s storage capacity, this trend continues as storage becomes cheaper with time. As a result, the time and effort needed to extract and analyze the data from a single device has increased in parallel.

According to Homem (2018), the backlog problem that has materialized due to the increase in data as well as diversity of digital evidence sources, is straining

(25)

digital forensics practitioners, labs and law enforcement agencies. Large evidence backlogs are causing long delays in investigations and legal processes, with cases being unable to progress.

Homem (2018), also stresses the importance of improved efficiency of the digital investigation process to be able to address the digital forensics backlog problem.

Improved efficiency of the processes involving digital evidence, by increasing the speed and reducing the expended human effort, is the only remedy to this problem (Ibid). Apart from being an effective way to improve efficiency, certain critics also argue that reducing human effort and human intervention is an effective way to minimize the risk of error or omission of key evidence (James & Glayshev, 2013).

The implications associated with large backlogs are various. Firstly, delay of examination of digital devices facilitates suppression of evidence. Delays in prose- cution of cases involving digital forensics also enables criminals to commit ad- ditional offenses while the evidence is waiting to be processed. The backlog problem is also forcing law enforcement agencies to prioritize high profile cases.

Lesser cases are likely to be deprioritized or discarded, due to law enforcement not possessing the necessary resources to address them (Vincze, 2016). Failing to successfully combat the issues that law enforcement agencies are experiencing as a consequence of large backlogs would prove problematic in regard to ensuring safe societies and the public’s trust in the legal system. Being unable to prosecute guilty criminals due to logistical reasons, jeopardizes the trust and confidence that society has in law enforcement (Ibid).

Although a considerable effort is put into training investigators and examiners there is still a widespread issue concerning under-qualified practitioners (Scan- lon, 2016). The inability to efficiently handle the increase in volume has created considerable backlog problems on a federal, state and well as local level. More- over, the diversity in digital devices required to be assessed in criminal cases is also contributing to the rise in backlog (Homem, 2018; Benkhelifa et al., 2016).

Despite the efforts of digital forensic laboratories, evidence backlogs of two years are not uncommon. In certain extreme cases, law enforcement agencies have had backlogs stretching back four years (Scanlon, 2016).

Lack of expertise

The increase of digital devices within criminal activity has led to a surge in demand for digital forensics professionals. As of August 2015, there were 30 000 un- filled digital forensic job positions in the United States alone. The rapid changes in forensic tools, techniques and standards also require on-going education and training, which can be difficult to manage in this already hectic field of work.

Therefore, the lack of adequately trained personnel has led to fierce competition between governmental agencies and private companies over the most competent applicants (Vincze, 2016).

(26)

Harkin et al (2018), address the issue that supervisors and higher management at law enforcement agencies generally lack the expertise and understanding to be able to make appropriate decisions regarding what the forensic examiners and investigators need to be able to do their jobs. Adding to that, Zahat (2019) addresses the importance of ensuring that digital forensics investigators possess the adequate skills and knowledge to successfully conduct investigations. It is compared to practicing medicine or law, which both require a substantial amount of studying before being able to be practised professionally. However, in order to perform digital forensic investigations, there are no foundational requirements.

Although there are several organizations and companies that provide training and certifications, these are not officially required to perform forensic investigations. Therefore, it is common for law enforcement agencies to be reluctant to invest in internal training and education (Zahat, 2019). Budget restrictions are also commonly preventing law enforcement units from acquiring the required knowledge and competence to effectively combat the increasing quantity of digital forensics cases (Harkin et al., 2018).

Vincze (2016), highlights some of the challenges that digital forensics units are facing due to the changes in consumer pattern. Historically, digital evidence was gathered from a single device. However, due to the rapid proliferation of digital devices in society, the average person today has five connected devices. This implies that a forensic investigation generally includes several devices, which all have to be examined for evidence. Due to the complexity and infrastructural differences of devices, one investigator rarely possesses the specialized knowledge required to examine different types of devices (Garfinkel, 2010). Therefore, a digital forensics investigation commonly requires several forensic experts working in tandem, to be able to correctly handle all the evidence from the different devices. This often implies logistical challenges for law enforcement agencies that handle large amounts of digital forensics cases (Vincze, 2016). Furthermore, the recent move from local physical storage of data to virtualized cloud computing, has also proven demanding for forensic experts. With data being stored on external servers located at different geographic locations, accessing the data becomes increasingly challenging, as DF-experts have reduced visibility and control over forensic artifacts (Ibid).

The automation dilemma

It is argued that the newly materialized challenges of digital investigations have created a necessity to reevaluate the efficiency and adequacy of the current state- of-the-art forensic tools (Vincze, 2016). First of all, these tools have failed to ac- climatize to the increase in storage capacity of contemporary devices. It is also argued that the increase in data capabilities will affect the way data is to be processed. As most modern cases include a variety of different devices, file formats, applications and data types, it requires tools that enable more sophisticated analysis techniques as well as collaborative functionality to effectively perform investigations. As a response to this, the current digital forensic tools are developing

(27)

and advancing more towards automation, with the ambition to become more effective. An evident repercussion is the issue of credibility and privacy associated with automating extraction, analysis and storage of data (Ibid).

Privacy, and especially credibility are crucial components for successful law enforcement within digital forensics. With tools automating large parts of the extraction and analysis phases of the digital forensics investigation process, it is reasonable to question and discuss the privacy and credibility implications of automation (Vincze, 2016). According to James and Gladyshev (2013), the digital forensics market has been sceptical to adopting tools for automating the investigation process. The authors argue that employing tools for automation may result in deterioration of knowledge among digital forensic experts, due to reliance on tools rather than individual expertise and judgement. Although automation is deemed necessary to streamline certain parts of an investigation, James and Gladyshev are of the opinion that it is problematic that higher-level forensic processes, such as analysis, adopt and rely too heavily on automation. The concern is that automation will result in investigators beginning to lose understanding of the underlying concepts of the investigations by blindly relying on the results that the tools produce. This can have a substantial impact on investigators’ ability to present evidence in legal and judicial environments. In order for evidence to be considered reliable and valid in court of law, the forensic investigator is required to understand and be able to clarify the process of how the evidence was forensically collected, which makes it almost as important as identifying the evidence in the first place (James & Gladyshav, 2013).

On the other hand, Garfinkel (2010) argues that these automated tools could enable lower barriers of entry for aspiring forensic professionals. Historically, ed- ucating an individual in digital forensics can take up to two years, due to the complex nature of the different digital forensic disciplines (Ibid). However, with automated tools that are easy to learn and use, less knowledge and skills are required from forensic investigators to be able to perform their tasks (Homem, 2018; Garfinkel, 2010).

Garfinkel (2010), also suggests that the lack of automation is a main reason for the substantial delays and backlogs that law enforcement agencies are experiencing.

This is further supported by Homem (2018), who argues that the implementing automation is necessary in order to achieve time and effort reduction within digital investigation processes.

Thus, it is evident that literature is not in agreement regarding whether increased automation is the most effective approach to employ within digital forensics, as it may affect the ability to produce accurate and reliable results (Vincze, 2016). The balance between efficiency, accuracy and reliability is important to assess. The speed at which you are able to acquire evidence is irrelevant if you are unable to ensure that the information that you have gathered is accurate and reliable. More- over, acquiring accurate evidence is meaningless if you aren’t able to produce the results quickly enough (Homem, 2018; Flandrin et al, 2014).

(28)

2.2 Organizational buying behavior

In order to be successful in any type of business-to-business, business-to-consumer or business-to-government environment, understanding a customer’s buying behavior is a crucial aspect. However, acquiring an understanding of how decisions within customers’ purchasing process are made, can be difficult. Especially when selling towards an organization, as the decision making process within organisational buying can be complex (Johnston & Lewin, 1996). Failing to adapt to customers’ and potential customers’ buying behavior is commonly a reason for why companies fail to keep and acquire new customers. Having a great product is often insufficient if you are unable to market it to your clients the right way.

Thus, establishing which issues and factors that directly or indirectly influence the buying behavior of a company is crucial to ensure a successful sales process (Webster & Wind, 1972; Walter & Murray, 1988).

The field of research that assesses this concept is commonly referred to as organisational buying behavior. In the late 1960s, researchers started to take interest in studying and understanding the buying process of organizations (Johnston &

Lewin, 1996). Prior to the 1960s, the available literature exclusively covered consumer buyer behavior, while essentially nothing had been written in regard to organizational and industrial buying behavior (Webster & Wind, 1972). Theory on consumer behavior is practically irrelevant in the context of selling towards an organization, due to the differences in the respective purchase processes (See figure 2.2).

FIGURE 2.2: General buying behavior, organizations and consumers; Extended from (Weele, 2005).

(29)

Organizational buying is to a larger extent influenced by cost, budget and profit considerations. Moreover, the decision making process within organizational buying typically involves interaction among individuals from different departments and of different authority levels. This makes organisational buying behavior more difficult to analyze and understand compared to regular consumer buying behavior. Thus, working with marketing and sales in a business-to-business environment requires more effort to be able to identify the key factors that influence a specific customer’s buying decision (Webster & Wind, 1972).

The purchasing behavior of an organization is generally a complex process involving different people with diverging goals and conflicting interests. The decision making process usually takes place over extended periods of time and requires several individuals of the organization to interconnect (Webster & Wind, 1972). The purchasing process commonly starts with someone within the organization identifying a problem or a need for change. This issue can then potentially be solved through a purchase. All organizational activities related to defining a purchasing need, as well as identifying, evaluating and choosing a supplier are included within the context of organizational buying behavior (Castleberry

& Tanner, 2011). In turn, all the members or groups of members of the organization that are actively involved in the different parts of the process, are included in what is commonly referred to as the buying center. The buying center is further discussed in section 2.2.2.

2.2.1 The Organizational Buying Process

To effectively sell to organizations, it is crucial to identify and understand how the target organization makes its purchasing decisions. In 1967, Robinson, Faris and Wind presented an eight-step model to illustrate the buying process of organizations (See figure 2.3). Although being almost half a century old, the model is still frequently used and is to a large extent still considered to be accurate in illustrating modern day organizational purchasing behavior. Dwyer and Tan- ner (2001), along with several other researchers have attempted to modernize the model. However, all attempts of improving the model are considered noticeably similar to the original eight step model from 1967.

(30)

FIGURE 2.3: The eight steps in an organizational buying process.

Extended from Robinson et al., 1967 & Dwyer & Tanner, 2001.

According to Castleberry and Tanner (2011), the eight steps of the organizational buying process are explained as follows:

Step 1: Recognition of need

The buying process is generally started when someone realizes that a problem exists. This problem recognition can be triggered by either an internal employee or by a salesperson demonstrating how their products or services can improve the operation of the organization.

Step 2: Defining the product-type needed

When a problem is identified, a solution needs to be formulated. Usu- ally most issues can be solved, or at least alleviated, by a product or through a service. The question then is, what product or service would solve these issues. Ideas for solutions can come from many different directions. However, they tend to come from employees with insight into the operations and insight into the products and services that could form a solution. Therefore, this step defines the solution in the context of a purchase.

(31)

Step 3: Development of detailed specification

Before investigating the different options in regard to suppliers, a detailed specification of the product or service needs to be prepared. This specification is required for suppliers to be able to develop proposals.

A detailed specification is also beneficial for the buyers, as it enables objective evaluation of the proposals.

Step 4: Search for qualified suppliers

After having established detailed product or service specifications, the buyer needs to identify potential suppliers. If no previous partner re- lationship exists with a supplier, the buyer may be required to perform an extensive search procedure in order to find potential candidates.

Step 5: Acquiring and analyzing proposals

The qualified suppliers can then send in their proposals for evaluation. Depending on the organization, the proposals can be developed in collaboration with the suppliers. In this stage, the product can also be tested and analyzed in order to acquire a practical understanding of its actual quality and ability to meet organizational needs. This process can improve the quality of the proposals and hopefully increase the value that the suppliers can deliver to the organization.

Step 6: Evaluating proposals and selecting suppliers

Thereafter, the organization takes their pick among the offered proposals. Further negotiations regarding price, specifications and time- frames can occur both during the selection process but also after a supplier is chosen.

Step 7: Placing an order and receiving the product

An order is placed with the desired supplier. The product or service is delivered and the supplier is paid by the buyer after careful inspection.

Step 8: Evaluating product performance

The last step of the process refers to evaluation of the performance of the product or service, as well as supplier performance. The sales personnel are important in this step as it is their responsibility to ensure that the expectations of the users of the product or service are met.

Furthermore, the salespeople also need to ensure that the buying organization is satisfied with the communication and delivery throughout the process, in order to enable a potentially long lasting customer rela- tionship.

(32)

2.2.2 Buy-classes Within Organizational Purchasing

Along with the eight step model of the organizational buying process discussed in the previous subsection, Robinson, Faris and Wind (1967) also highlight three different types of buy-classes; new task, straight rebuy or modified rebuy. When an organization decides to purchase a product or service, the purchase can generally be categorized within one of these three buy-classes.

New Task

The new task buy-class implies that an organization purchases a product or service for the first time. Since the organization has limited prior knowledge and buying experience, a great deal of information is required before committing to a purchase. Due to the increased risk associated with first time purchases, buyers tend to seek advice and guidance from salespeople. This is especially relevant for the first three steps of the organizational buying process, as the salespeople are encouraged to help the buyers to define characteristics of the needed products.

Thus, the salespeople are also able to influence the development of the purchase specification. This type of buy-class tends to occur rather infrequently. However, when it does, the buyer usually needs to go through all eight steps of the buying process (Robinson et al., 1967).

Straight Rebuy

Straight rebuy refers to a purchase situation where an organization buys the same product or service from the same supplier as it has previously. Since prior purchasing experience exists, the organization/buyer possesses considerable knowledge regarding the product requirements and the different suppliers. Straight rebuy is typically triggered from within the organization itself, and is generally not influenced by external actors, such as salespeople. As needs, product requirements and potential suppliers are easily identified due to prior knowledge and experience, the early steps of the purchasing process are of less importance. In- stead, the last four steps of the purchasing process are the most crucial within this type of buy-class. Many organizations already have satisfactory supplier re- lationships and product specifications in place, which implies minimal effort in the buying process. Thus, companies should make efforts to keep good relations with their customers to ensure straight rebuys and prevent their customers from turning to their competitors (Castleberry & Tanner, 2011).

Modified Rebuy

For modified rebuy purchases, the organization has purchased the same or a similar product in the past, but is interested in changing either the product or the supplier. This type of buy-class generally occurs as a consequence of dissatisfac- tion of supplier performance, a new or improved product becoming available or just a general change in customer demand. Within this type of buy-class, there are great opportunities for external suppliers to break up an existing partnership, by better meeting the demand of the buyer. The key steps of the buying process

(33)

affecting modified rebuy are the middle four, as these are the ones that will affect this buy-class the most (Castleberry & Tanner, 2011).

Key Steps

For different types of buying classes, different steps of the purchasing process are more or less vital, see figure 2.4. For new task purchases, steps 1-3 are crucial. For modified rebuy purchases, steps 3-6 are the most important. And lastly, for straight rebuy purchases, step 5-8 are the ones that need to be primarily assessed.

FIGURE 2.4: The key steps associated with different types of buy- classes in a buying process (Extended from Castleberry & Tanner,

2011).

2.2.3 The Buying Center

Organizational behaviour tends to differ from regular consumer behavior when it comes to making purchases (See figure 2.2). The organization prioritizes purchases that would add to productivity as opposed to consumers that tend to purchase products that connect to them on a personal plane. Organizations are able to make more objective purchase decisions through what is commonly referred to as buying centers. The buying center is defined by all the members in the organization that are involved in the purchasing decision of a specific product or service (Wind, 1978a). The buying center is generally composed of both managers, that can take the organization’s strategic goals into consideration, as well as internal experts that are familiar with the product or service in question. The number of members in the buying center varies depending on the type of organizations and the type of purchase. Centralized organizations making large purchases typically involve large buying centers. On the opposite side of the spectrum, there are decentralized organizations making small purchases with relatively few members in their buying centers (Wind, 1978b).

Addressing the Digital Forensic Challenges Within Modern Law Enforcement