Digital Investigation

About Digital Investigation

Digital Investigation — Full Journal Profile

Digital Investigation was the specialist Elsevier journal for digital forensic science, published in the United Kingdom from the early years of the discipline until it was continued, from 2020, as Forensic Science International: Digital Investigation. Under its original title it carried the print ISSN 1742-2876 and the electronic ISSN 1873-202X, and it served as a central peer-reviewed venue for the Digital Forensic Research Workshop (DFRWS) community, for forensic tool validation studies, and for the legal and procedural scholarship that surrounds digital evidence. This profile documents the original title, its scope and community, and its continuation, so that readers who meet the name in citations from the 2000s and 2010s can place it correctly in the current journal landscape.

Digital evidence differs from most scientific evidence in one decisive way: it is created, stored and altered by systems that were designed for convenience, not for court. Establishing what a file, log or device can actually prove — its provenance, integrity and authenticity — is a scientific problem before it is a legal one, and Digital Investigation was built around that problem. Its pages mixed computer science, forensic practice, law and incident response in a combination few other journals attempted, which is why its article stock is still cited by practitioners, laboratories and courts-facing experts long after the title changed.

At a Glance

History and Continuation

Digital Investigation grew up alongside organised digital forensics in the 2000s, closely associated with the DFRWS conference community whose proceedings and selected papers it published, including the annual DFRWS USA and DFRWS Europe supplements that appear throughout its later volumes. The journal published quarterly in its established pattern and built a substantial volume run under the original title through the 2010s.

Elsevier then folded the title into its Forensic Science International family. The publisher author information for the successor states the change plainly in summary: Digital Investigation is continued as Forensic Science International: Digital Investigation. The successor began in 2020 with its own ISSNs — 2666-2817 for the online edition and 2666-2825 for print — and its own volume numbering, while keeping the same subject community and a closely related editorial mission. Citations therefore split at the change: work published before the continuation is cited to Digital Investigation with ISSN 1742-2876, and work published from 2020 onward is cited to the successor title. The two records should not be merged in a bibliography, a library catalogue or a metrics profile.

Scope in Detail

The successor description, which continues the original remit, frames the field as digital and multimedia forensic science and evidence-based incident response, centred on digital evidence and multimedia with provenance, integrity and authenticity as core qualities. The original title published across the same territory, in the recurring families below.

File system and storage forensics. Analysis of file systems, solid-state storage behaviour, deleted data recovery, timeline reconstruction and artefact interpretation on disks, memory cards and mobile storage, including validation of what common tools report.

Memory and network forensics. Acquisition and analysis of volatile memory, network traffic and logs, and the reconstruction of events from distributed and cloud-based systems where no single device holds the whole record.

Mobile and embedded device forensics. Extraction and interpretation of data from phones, tablets, vehicles, drones and internet-connected devices, where proprietary formats and encryption complicate standard workflows.

Multimedia forensics. Authentication and analysis of images, audio and video, detection of manipulation, and source identification for recordings offered as evidence.

Malware and incident response. Forensic analysis of malicious software, intrusion timelines, and evidence-based incident response methods that preserve evidential quality while an organisation recovers.

Anti-forensics and encryption. Research on techniques intended to hide, destroy or render evidence inaccessible, and on lawful, validated responses available to investigators.

Tool validation and method science. Controlled testing of forensic tools and methods, error-rate and reliability studies, and the scientific foundations work the discipline needs for evidence to withstand scrutiny.

Law, procedure and admissibility. Scholarship on search and seizure of digital evidence, disclosure, expert testimony, privacy, cross-border data access and the procedural rules that decide whether technically sound findings can be used.

Education and practice. Training, laboratory quality management, proficiency testing and professional practice studies for forensic laboratories, investigative agencies and security teams.

Cybercrime investigation. Case-method and analytical research on investigating cybercrime, cyberattacks and traditional crimes in which digital evidence is decisive, for readers in law enforcement, industry and academia.

Editorial Community and Article Types

The journal audience, as described for its successor and true of the original title, spans investigative agencies and forensic laboratories, computer security teams, practitioners, researchers, developers and lawyers from industry, law enforcement and academia. That mixed readership shaped its article mix: full research papers, practice and case-oriented contributions, tool and method validation studies, and the DFRWS proceedings supplements that gave conference work an archival, citable journal home. Special and supplementary issues were a structural feature, not an exception, because the field organises much of its rapid exchange through its workshop community.

Peer review was by external subject experts under Elsevier journal procedures. Because forensic methods may be tested in legal proceedings, the journal placed unusual weight on reproducibility of method: acquisition procedures, tool versions, hash verification and chain-of-custody reasoning needed to be reported with enough precision for another examiner to repeat the work. Authors new to the field should read the backfile with that expectation in mind — papers that omit acquisition detail are the exception, and the norm is explicit method reporting.

Publication Model and Access

Digital Investigation was a subscription journal with an author open access option under Elsevier hybrid arrangements during its later years, rather than a fully open access title. Readers normally accessed it through institutional ScienceDirect subscriptions, and the backfile remains on ScienceDirect under the original title and ISSN. Article charges for the optional open route, where an author chose it, followed the Elsevier price list of the year of acceptance; a single current fee for the closed original title is not published, because the title no longer accepts manuscripts, and presenting a historical optional charge as a current price would mislead authors. Current fees, where they apply, belong to the successor journal and are stated on its current publisher pages.

Copyright and reuse therefore vary article by article in the backfile. Subscription articles carry publisher copyright terms, while articles published through the open route carry the licence printed on the article itself. Readers reusing figures or extended material should check the individual article rather than assume a journal-wide licence, which is the opposite situation from a fully open access BMC title.

Indexing, Metrics and Standing

The original title was abstracted and indexed in services recorded for it including Scopus and the Science Citation Index Expanded line of coverage, together with specialist computer science and forensic listings, and its articles are widely discoverable through Google Scholar and ScienceDirect. Its standing in the field rested less on a single metric than on its role as the DFRWS-linked archival journal: for many years, if a digital forensic method was presented to the community and then archived in a peer-reviewed journal, this was the most likely home.

Metrics for the successor title from 2020 onward — including its CiteScore and journal impact figures reported in recent years — belong to Forensic Science International: Digital Investigation under its own ISSNs. They indicate that the community and its citation activity carried across the title change, but they are not metrics of the original title and should not be back-attributed to it. Historical assessment of Digital Investigation itself should use the citation record of its own volumes.

How the Title Change Affects Authors and Readers

Authors with new work in digital forensics should submit to the successor journal or to another active venue, following the current guide for authors of the title they choose. Authors citing earlier work should preserve the original citation exactly as published, including the Digital Investigation title, its volume and its page or article details, even though the journal home page now resolves within the Forensic Science International family on ScienceDirect. Librarians should keep both title records, linked as earlier and later titles, because interlibrary supply and holdings statements depend on which title a given volume appeared under.

Researchers conducting a systematic search across the change must search both titles and both ISSN sets, and should state in their methods that they did so. Searching only the successor title silently truncates the evidence base at 2020, while searching only the original title misses the current literature entirely. The same caution applies to citation chasing from DFRWS proceedings papers, many of which sit in the original title supplements.

Working With This Backfile: A Practical Guide for Examiners and Researchers

A digital forensic backfile has to be read differently from a general computer science backfile, because the operational environment changes underneath the science. A method validated against one generation of phones, file systems or messaging applications may be scientifically sound and operationally obsolete at the same time, while a legal analysis may remain authoritative long after the software it discusses has vanished. Readers should therefore date every claim they take from the original title: record the tool versions, operating systems, application versions and legal provisions the paper actually studied, and check whether a successor-title paper has revalidated, extended or replaced the method before relying on it in casework or in a literature review.

That discipline is especially important for artefact studies. Artefact locations move between application releases, timestamps change their meaning when a platform changes its storage design, and encryption defaults that were optional in the period of the original title became standard later. The original papers remain the primary record of how an artefact behaved at the time, which is exactly what a historical reconstruction or a cold-case review needs, but a current examination needs current validation. Good practice, of the kind the journal community itself promotes, is to cite the original method paper for the principle and a recent validation for the present tool chain, rather than forcing either source to do both jobs.

For academic researchers, the title run plus its successor offers a unusually complete view of a discipline professionalising. Early digital forensic writing often described craft practice; the journal literature shows the field progressively demanding controlled experiments, known error behaviour, standardised reporting and peer challenge. Tracing a single topic, such as mobile device extraction or multimedia authentication, across the original title and into the successor shows that professionalisation topic by topic, with the DFRWS supplements marking the points where community consensus formed. Doctoral students entering the field can use that arc to position a new contribution honestly: what was shown, in which environment, with what limits, and what remains open.

For lawyers and expert witnesses, the backfile serves a different purpose. It documents the state of knowledge available to an examiner at a given date, which can matter when historic examinations are reviewed. A technique that looks weak by current standards may have been the accepted, published method of its year, and conversely a claim presented as novel in court may turn out to have a long published history of known limitations in this journal. Searching the title before an examination, a report or a hearing is therefore not academic decoration; it is part of due diligence in a field where published method science and courtroom reliability are directly connected.

Special Issues, Supplements and the Conference Connection

The supplement tradition deserves separate explanation because it accounts for a large share of the citations to this title. The DFRWS meetings function as the field workshop of record, where tool developers, laboratory scientists and academic researchers test new methods in front of the community that will use them. Selected and extended work from those meetings appeared in the journal as supplements, clearly identified with the meeting and year. A reader who finds a supplement paper should cite it as a journal article, because that is what it is, while noting the meeting connection where the paper itself states it. The arrangement gave conference research a permanent, indexed and peer-reviewed form at a time when much digital forensic knowledge circulated only in presentations, practitioner blogs and tool documentation, and it is a major reason the journal backfile is more complete as a record of the field than a conventional journal run of the same size would be.

Supplements also explain some structural features of the backfile that can puzzle a newcomer: issues that are much larger than a normal quarterly issue, clusters of papers sharing a theme and a year, and author communities that recur across consecutive supplements. None of that indicates irregularity. It indicates a journal deliberately serving as the archival arm of a conference community, a model several fast-moving technical fields adopted in the same period. When the title continued into the Forensic Science International family, that community relationship continued with it, which is why the successor should be searched together with this title by anyone mapping the field literature across the change of name.

How to Verify This Record and Use the Archive

Readers should verify any bibliographic detail that matters for citation, library holdings or submission decisions against the publisher record and the ISSN record for the title, because serial titles change, merge and cease over time. Check the ISSN exactly as printed on the article PDF or the publisher volume page, confirm the volume and year correspond to the period when the title was active under that name, and record the digital object identifier where one was assigned. Where a successor title exists, citations to articles published under the earlier title remain under the earlier title and should not be rewritten to the successor name. Libraries preserve the run under the original title, and citation databases keep the historical coverage separate for exactly that reason. If a detail in this profile is described as not publicly disclosed or as something that could not be verified, that wording is deliberate: it means no authoritative publisher or registry source confirming the detail was found during research for this profile, and the detail has therefore been left open rather than filled with an estimate.

This profile is an independent directory description prepared for Journals World. It is not published by the journal or its publisher, it does not reproduce publisher marketing text, and it does not confer indexing, accreditation or endorsement. Journal metrics quoted in general terms refer to the historical record of the title; a ceased or renamed title no longer receives a current-year metric under its old name, and any metric attached to a successor title belongs to the successor. Authors with a new manuscript should follow the guidance in the submission section of this profile and use the current publisher instructions for the active title that now covers the field.

Frequently Asked Questions

Is this journal still accepting submissions under this title? The answer is given in the status line of the fact table and explained in the history section. Where a title has ceased or has been continued under a new name, new submissions go to the successor or to another active journal in the field, not to an archive address for the old title.

Can I still read and cite articles published in this journal? Yes. Ceased and renamed journals remain fully citable. Their backfiles are normally preserved by the publisher and by libraries, and citations continue to be counted under the original title and ISSN.

Where can I confirm the ISSN? In the ISSN Portal, in national library catalogues, in the publisher volume listing and on the articles themselves. The ISSN values in the fact table of this profile are the values those sources record for this title.

Does this profile list an article fee? Only where a publisher officially stated fee was verified for the active title. For ceased titles, historical fee information is not presented as a current price, and any fee that could not be verified from an official source is described as not publicly disclosed in current form rather than estimated.