Developing a Digital Forensics Investigation Framework for Nigerian Law Enforcement Agencies

Nigerian law enforcement agencies including the Economic and Financial Crimes Commission and the Nigeria Police Force increasingly encounter cybercrime evidence in criminal investigations, yet lack formalised digital forensics investigation frameworks that meet evidentiary standards for Nigerian courts. This study developed a digital forensics investigation framework aligned to Nigerian legal and procedural requirements. A professional forensics methodology drawing on the ACPO Good Practice Guide for Digital Evidence, ISO/IEC 27037 digital evidence standards, and structured interviews with 12 EFCC and Police CID cybercrime unit investigators was applied. The interviews revealed that 78 percent of investigators had never received formal digital forensics training, forensically sound evidence acquisition was performed in only 34 percent of cases reviewed, and chain of custody documentation was absent in 61 percent of digital evidence submissions. The framework developed encompasses six phases: investigation authorisation and scope, evidence identification and triage, forensically sound acquisition, preservation and chain-of-custody management, analysis and examination, and court-ready reporting. Platform-specific acquisition guidelines covering Windows PC, Android mobile, cloud account, and social media evidence types are provided. A chain-of-custody form template meeting Nigerian Evidence Act 2011 requirements is included. Expert validation with four certified forensics examiners and two senior prosecutors confirmed the framework's legal admissibility alignment. The study recommends mandatory digital forensics training certification for all EFCC and NPF cybercrime investigators and investment in open-source forensics tools (Autopsy, Volatility, Wireshark) for budget-constrained agencies.

Keywords: digital forensics, cybercrime investigation, EFCC, Nigeria Police Force, evidence standards