{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,20]],"date-time":"2026-10-20T02:48:19Z","timestamp":1792464499983,"version":"4.5.0"},"reference-count":69,"publisher":"MDPI AG","issue":"4","license":[{"start":{"date-parts":[[2017,3,28]],"date-time":"2017-03-28T00:00:00Z","timestamp":1490659200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>Digital triage is the first investigative step of the forensic examination. The digital triage comes in two forms, live triage and post-mortem triage. The primary goal of the live triage is a rapid extraction of an intelligence from the potential sources. The live triage raises legitimate concerns. The post-mortem triage is conducted in the laboratory and its main goal is ranking of the seized devices for the possible existence of the relevant evidence. The digital triage has the potential to quickly identify items that are likely to contain the evidential data. Therefore, it is a solution to the problem of case backlogs. However, existing methods and tools of the digital triage have limitations, especially, in the forensic context. Nevertheless, we have no better solution for the time being. In this paper, we critically review published research works and the proposed solutions for digital triage. The review is divided into four sections as follows: live triage, post-mortem triage, mobile device triage, and triage tools. We conclude that many challenges are awaiting for the developers in creating methods and tools of digital triage in order to keep pace with the development of new technologies.<\/jats:p>","DOI":"10.3390\/sym9040049","type":"journal-article","created":{"date-parts":[[2017,3,28]],"date-time":"2017-03-28T10:24:33Z","timestamp":1490696673000},"page":"49","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":22,"title":["Methods and Tools of Digital Triage in Forensic Context: Survey and Future Directions"],"prefix":"10.3390","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3083-9048","authenticated-orcid":false,"given":"Vacius","family":"Jusas","sequence":"first","affiliation":[{"name":"Software Engineering Department, Kaunas University of Technology, Studentu St. 50, LT-51368 Kaunas, Lithuania"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Darius","family":"Birvinskas","sequence":"additional","affiliation":[{"name":"Computer Department, Kaunas University of Technology, Studentu St. 50, LT-51368 Kaunas, Lithuania"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Elvar","family":"Gahramanov","sequence":"additional","affiliation":[{"name":"Software Engineering Department, Kaunas University of Technology, Studentu St. 50, LT-51368 Kaunas, Lithuania"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2017,3,28]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"89","DOI":"10.1016\/j.diin.2013.03.003","article-title":"Hunting in the enterprise: Forensic triage and incident response","volume":"10","author":"Moser","year":"2013","journal-title":"Digit. Investig."},{"key":"ref_2","first-page":"27","article-title":"Computer forensics field triage process model","volume":"1","author":"Rogers","year":"2006","journal-title":"J. Digit. Forensic Secur. Law"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"1353","DOI":"10.1111\/j.1556-4029.2009.01150.x","article-title":"Investigation delayed is justice denied: proposals for expediting forensic examinations of digital evidence","volume":"54","author":"Casey","year":"2009","journal-title":"J. Forensic Sci."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1016\/j.diin.2013.08.001","article-title":"Triage in digital forensics","volume":"10","author":"Casey","year":"2013","journal-title":"Digit. Investig."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"A1","DOI":"10.1016\/j.diin.2016.11.001","article-title":"Differentiating the phases of digital investigations","volume":"19","author":"Casey","year":"2016","journal-title":"Digit. Investig."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Ven\u010dkauskas, A., Jusas, V., Paulikas, K., and Toldinas, J. (2016). A methodology and tool for investigation of artifacts left by the BitTorrent client. Symmetry, 8.","DOI":"10.3390\/sym8060040"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"158","DOI":"10.1016\/j.diin.2013.02.001","article-title":"Real-time digital forensics and triage","volume":"10","author":"Roussev","year":"2013","journal-title":"Digit. Investig."},{"key":"ref_8","first-page":"69","article-title":"Formal Two Stage Triage Process Model (FTSTPM) for Digital Forensic Practice","volume":"10","author":"Montasari","year":"2016","journal-title":"Int. J. Comput. Sci. Secur."},{"key":"ref_9","first-page":"99","article-title":"Implementing the automated phases of the partially-automated digital triage process model","volume":"7","author":"Cantrell","year":"2012","journal-title":"J. Digit. Forensics Secur. Law"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1016\/j.dss.2014.01.007","article-title":"A case-based reasoning method for locating evidence during digital forensic device triage","volume":"61","author":"Horsman","year":"2014","journal-title":"Decis. Support Syst."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"129","DOI":"10.1016\/j.diin.2013.03.002","article-title":"Automated network triage","volume":"10","author":"Koopmans","year":"2013","journal-title":"Digit. Investig."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"S60","DOI":"10.1016\/j.diin.2012.05.012","article-title":"Content triage with similarity digests: The M57 case study","volume":"9","author":"Roussev","year":"2012","journal-title":"Digit. Investig."},{"key":"ref_13","first-page":"29","article-title":"Research toward a partially-automated, and crime specific digital triage process model","volume":"5","author":"Cantrell","year":"2012","journal-title":"Comput. Inf. Sci."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"175","DOI":"10.1016\/j.diin.2013.01.003","article-title":"A new triage model conforming to the needs of selective search and seizure of electronic evidence","volume":"10","author":"Hong","year":"2013","journal-title":"Digit. Investig."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"116","DOI":"10.1016\/j.diin.2013.04.003","article-title":"A practical and robust approach to coping with large volumes of data submitted for digital forensic examination","volume":"10","author":"Shaw","year":"2013","journal-title":"Digit. Investig."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"87","DOI":"10.1016\/j.diin.2013.01.002","article-title":"Triage: A practical solution or admission of failure","volume":"10","author":"Pollitt","year":"2013","journal-title":"Digit. Investig."},{"key":"ref_17","first-page":"156","article-title":"Using the RetSim fraud simulation tool to set thresholds for triage of retail fraud","volume":"Volume 9417","author":"Axelsson","year":"2015","journal-title":"Lecture Notes in Computer Science, Proceedings of the 20th Nordic Conference on Secure IT Systems, Stockholm, Sweden, 19\u201321 October 2015"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Perumal, S., Norwawi, N.M., and Raman, V. (2015, January 7\u20139). Internet of Things (IoT) digital forensic investigation model: Top-down forensic approach methodology. Proceedings of the Fifth International Conference on Digital Information Processing and Communications (ICDIPC), Sierre, Switzerland.","DOI":"10.1109\/ICDIPC.2015.7323000"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"74","DOI":"10.1016\/j.forsciint.2016.01.016","article-title":"Development of a systematic computer vision-based method to analyse and compare images of false identity documents for forensic intelligence purposes\u2014Part I: Acquisition, calibration and validation issues","volume":"260","author":"Auberson","year":"2016","journal-title":"Forensic Sci. Int."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"168","DOI":"10.1016\/j.diin.2013.03.001","article-title":"Triage template pipelines in digital forensic investigations","volume":"10","author":"Overill","year":"2013","journal-title":"Digit. Investig."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"379","DOI":"10.1007\/s10660-013-9119-y","article-title":"A framework for unified digital evidence management in security convergence","volume":"13","author":"Lim","year":"2013","journal-title":"Electron. Commer. Res."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"S34","DOI":"10.1016\/j.diin.2015.05.006","article-title":"Rapid forensic imaging of large disks with sifting collectors","volume":"14","author":"Grier","year":"2015","journal-title":"Digit. Investig."},{"key":"ref_23","unstructured":"Garfinkel, S., Malan, D., Dubec, K.-A., Stevens, C., and Pham, C. (2006). Proceedings of 2nd International Conference on Digital Forensics, Orlando, FL, January 29-February 01 2006, Springer. Advances in Digital Forensics II. IFIP Advances in Information and Communication, vol. 222."},{"key":"ref_24","unstructured":"The Sleuth Kit (2017, March 25). Autopsy. Available online: http:\/\/www.sleuthkit.org\/autopsy\/."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"S22","DOI":"10.1016\/j.diin.2015.01.007","article-title":"Fast contraband detection in large capacity disk drives","volume":"12","author":"Penrose","year":"2015","journal-title":"Digit. Investig."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"94","DOI":"10.1016\/j.diin.2015.04.004","article-title":"Automated event and social network extraction from digital evidence sources with ontological mapping","volume":"13","author":"Turnbull","year":"2015","journal-title":"Digit. Investig."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"S75","DOI":"10.1016\/j.diin.2016.01.010","article-title":"Tiered forensic methodology model for Digital Field Triage by non-digital evidence specialists","volume":"16","author":"Hitchcock","year":"2016","journal-title":"Digit. Investig."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"96","DOI":"10.1016\/j.diin.2016.07.003","article-title":"A RAM triage methodology for Hadoop HDFS forensics","volume":"18","author":"Leimich","year":"2016","journal-title":"Digit. Investig."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1016\/j.diin.2016.07.002","article-title":"iCOP: Live forensics to reveal previously unknown criminal media on P2P networks","volume":"18","author":"Peersman","year":"2016","journal-title":"Digit. Investig."},{"key":"ref_30","unstructured":"iCOP (2017, March 25). iCOP Toolkit. Available online: http:\/\/scc-sentinel.lancs.ac.uk\/icop\/?q=content\/icop-toolkit."},{"key":"ref_31","first-page":"723","article-title":"Big forensic data reduction: Digital forensic images and electronic evidence","volume":"19","author":"Quick","year":"2016","journal-title":"Clust. Comput. J. Netw. Softw. Tools Appl."},{"key":"ref_32","first-page":"1","article-title":"Data reduction and data mining framework for digital forensic evidence: Storage, intelligence, review and archive","volume":"480","author":"Quick","year":"2014","journal-title":"Trends Issues Crim. Crim. Justice"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"193","DOI":"10.1016\/j.diin.2013.01.001","article-title":"A machine learning-based triage methodology for automated categorization of digital media","volume":"10","author":"Marturana","year":"2013","journal-title":"Digit. Investig."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Marturana, F., Me, G., Berte, R., and Tacconi, S. (2011, January 16\u201318). A quantitative approach to triaging in mobile forensics. Proceedings of the International Joint Conference of IEEE TrustCom-11, Changsha, China.","DOI":"10.1109\/TrustCom.2011.75"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Marturana, F., Bert\u00e8, R., Tacconi, S., and Me, G. (2012, January 14\u201315). Triage-based automated analysis of evidence in court cases of copyright infringement. Proceedings of the First IEEE International Workshop on Security and Forensics in Communication Systems (SFCS 2012), Ottawa, ON, Canada.","DOI":"10.1109\/ICC.2012.6364819"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"McClelland, D., and Marturana, F. (2014, January 10\u201314). A Digital Forensics Triage methodology based on feature manipulation techniques. Proceedings of the International Conference on Communications, Sydney, Australia.","DOI":"10.1109\/ICCW.2014.6881277"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Horsman, G., Laing, C., and Vickers, P. (2012, January 25\u201327). A case based reasoning framework for improving the trustworthiness of digital forensic investigations. Proceedings of the 11th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom-2012), Liverpool, UK.","DOI":"10.1109\/TrustCom.2012.18"},{"key":"ref_38","unstructured":"(2017, March 25). EnCase Portable. Available online: http:\/\/www.guidancesoftware.com\/encase-portable."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"8","DOI":"10.1016\/S1361-3723(15)30018-X","article-title":"A triage framework for digital forensics","volume":"2015","author":"Bashir","year":"2015","journal-title":"Comput. Fraud Secur."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"58","DOI":"10.1016\/j.diin.2015.04.002","article-title":"Monte-Carlo filesystem search: A crawl strategy for digital forensics","volume":"13","author":"Dalins","year":"2015","journal-title":"Digit. Investig."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"65","DOI":"10.1016\/j.diin.2016.08.001","article-title":"A suspect-oriented intelligent and automated computer forensic analysis","volume":"18","author":"Clarke","year":"2016","journal-title":"Digit. Investig."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"112","DOI":"10.1016\/j.diin.2010.03.001","article-title":"The growing need for on-scene triage of mobile devices","volume":"6","author":"Mislan","year":"2010","journal-title":"Digit. Investig."},{"key":"ref_43","unstructured":"Walls, R.J., Learned-Miller, E., and Levine, B.N. (2011, January 8\u201312). Forensic triage for mobile phones with DEC0DE. Proceedings of the 20th USENIX Conference on Security, San Francisco, CA, USA."},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Varma, S., Walls, R.J., Lynn, B., and Levine, B.N. (2014, January 3\u20137). Efficient smart phone forensics based on relevance feedback. Proceedings of the 4th ACM Workshop on Security and Privacy in Smartphones & Mobile Devices (SPSM \u201914), Scottsdale, AZ, USA.","DOI":"10.1145\/2666620.2666628"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"56","DOI":"10.1016\/j.cose.2012.09.011","article-title":"Digital media triage with bulk data analysis and bulk_extractor","volume":"32","author":"Garfinkel","year":"2013","journal-title":"Comput. Secur."},{"key":"ref_46","unstructured":"(2017, March 25). Yaffs. Available online: http:\/\/www.yaffs.net\/."},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"S46","DOI":"10.1016\/j.diin.2016.04.012","article-title":"Rapid differential forensic imaging of mobile devices","volume":"18","author":"Guido","year":"2016","journal-title":"Digit. Investig."},{"key":"ref_48","unstructured":"(2017, March 25). sdhash home. Available online: http:\/\/roussev.net\/sdhash\/sdhash.html."},{"key":"ref_49","unstructured":"CAINE (2017, March 27). Computer Forensics Linux Live Distro. Available online: http:\/\/www.caine-live.net\/."},{"key":"ref_50","unstructured":"KALI Tools (2017, March 25). RegRipper. Available online: http:\/\/tools.kali.org\/forensics\/regripper."},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"223","DOI":"10.1016\/j.mcm.2011.05.019","article-title":"On-the-spot digital investigation by means of LDFS: Live Data Forensic System","volume":"55","author":"Lim","year":"2012","journal-title":"Math. Comput. Model."},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"138","DOI":"10.1016\/j.diin.2013.07.002","article-title":"Honing digital forensic processes","volume":"10","author":"Casey","year":"2013","journal-title":"Digit. Investig."},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"S13","DOI":"10.1016\/j.diin.2010.05.003","article-title":"Using purpose-built functions and block hashes to enable small block and sub-file forensics","volume":"7","author":"Garfinkel","year":"2010","journal-title":"Digit. Investig."},{"key":"ref_54","doi-asserted-by":"crossref","first-page":"S101","DOI":"10.1016\/j.diin.2011.05.012","article-title":"Distributed forensics and incident response in the enterprise","volume":"8","author":"Cohen","year":"2011","journal-title":"Digit. Investig."},{"key":"ref_55","doi-asserted-by":"crossref","first-page":"99","DOI":"10.1016\/j.diin.2013.04.002","article-title":"On-scene triage open source forensic tool chests: Are they effective?","volume":"10","author":"Shiaeles","year":"2013","journal-title":"Digit. Investig."},{"key":"ref_56","doi-asserted-by":"crossref","unstructured":"Woods, K., Lee, C.A., and Misra, S. (2013, January 2\u20135). Automated analysis and visualization of disk images and file systems for preservation. Proceedings of the 10th IS & T Archiving Conference, Washington, DC, USA.","DOI":"10.2352\/issn.2168-3204.2013.10.1.art00051"},{"key":"ref_57","unstructured":"(2017, March 25). BitCurator. Available online: https:\/\/www.bitcurator.net\/."},{"key":"ref_58","unstructured":"(2017, March 25). Fiwalk. Available online: http:\/\/www.forensicswiki.org\/wiki\/Fiwalk."},{"key":"ref_59","unstructured":"Baggili, I., Marrington, A., and Jafar, Y. (2014). IFIP Advances in Information and Communication Technology, Springer."},{"key":"ref_60","doi-asserted-by":"crossref","first-page":"358","DOI":"10.1108\/IMCS-11-2013-0080","article-title":"Forensic triage of email network narratives through visualisation","volume":"22","author":"Haggerty","year":"2014","journal-title":"Inf. Manag. Comput. Secur."},{"key":"ref_61","doi-asserted-by":"crossref","first-page":"S45","DOI":"10.1016\/j.diin.2014.03.006","article-title":"OpenLV: Empowering investigators and first-responders in the digital forensics process","volume":"11","author":"Vidas","year":"2014","journal-title":"Digit. Investig."},{"key":"ref_62","first-page":"16","article-title":"Development and Initial User Evaluation of a Virtual Crime Scene Simulator Including Digital Evidence","volume":"Volume 157","author":"Conway","year":"2015","journal-title":"Lecture Notes of the Institute for Computer Sciences Social Informatics and Telecommunications Engineering, Proceedings of the 7-th International ICST Conference on Digital Forensics and Cyber Crime (ICDF2C), Seoul, South Korea, October 6\u20138, 2015"},{"key":"ref_63","unstructured":"(2017, March 27). Unity. Available online: https:\/\/unity3d.com\/."},{"key":"ref_64","doi-asserted-by":"crossref","unstructured":"Hegarty, R., and Haggerty, J. (2015, January 7\u20139). SlackStick: Signature-based file identification for live digital forensics examinations. Proceedings of 2015 European Intelligence and Security Informatics Conference, Manchester, UK.","DOI":"10.1109\/EISIC.2015.28"},{"key":"ref_65","unstructured":"(2017, March 27). Slax Linux. Available online: https:\/\/www.slax.org\/."},{"key":"ref_66","doi-asserted-by":"crossref","first-page":"20","DOI":"10.1016\/j.diin.2015.07.004","article-title":"Digital forensics as a service: Game on","volume":"15","author":"Ugen","year":"2015","journal-title":"Digit. Investig."},{"key":"ref_67","unstructured":"(2017, March 27). Hansken. Available online: https:\/\/www.forensicinstitute.nl\/products_and_services\/forensic_products\/hansken.aspx."},{"key":"ref_68","doi-asserted-by":"crossref","first-page":"96","DOI":"10.1016\/j.diin.2012.10.001","article-title":"Engineering an online computer forensic service","volume":"9","author":"Bhoedjang","year":"2012","journal-title":"Digit. Investig."},{"key":"ref_69","doi-asserted-by":"crossref","first-page":"S138","DOI":"10.1016\/j.diin.2016.04.008","article-title":"InVEST: Intelligent visual email search and triage","volume":"18","author":"Koven","year":"2016","journal-title":"Digit. Investig."}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/9\/4\/49\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T18:31:25Z","timestamp":1760207485000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/9\/4\/49"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,3,28]]},"references-count":69,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2017,4]]}},"alternative-id":["sym9040049"],"URL":"https:\/\/doi.org\/10.3390\/sym9040049","relation":{},"ISSN":["2073-8994"],"issn-type":[{"value":"2073-8994","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,3,28]]}}}