But there are some very fundamental problems. For example, storage capacity is increasingly dramatically-so the sheer volume of evidence to sort through is going up. And even if you can deal with the volume problem, you've got to overcome other obstacles-for example, encryption and steganography. Another problem is that the evidence you are seeking could be stored anywhere-because there is a lot more remote storage. There are also too few people working in computer forensics, the number is increasing, but it is insufficient for the problems we're facing.
Law enforcement is, of course, automating the forensics process.
But there are limitations to all these tools. For example, you can't analyze strings or search for strings if the data is encrypted. But even if you seize clear text or succeed in decrypting the data, you still have the problem of how to search for something. For example, let's say there's a meeting on September 4, in which the conspirators finalize the plans to bomb the building. You want to find any reference to the September 4 meeting in the suspect's electronic diary.