Europol has counted the gaps in digital forensics. You have most of them too.

In summer 2026 the European Commission, together with Europol, published a stocktake: Digital Forensics: Gap Analysis. The forensic units of the Member States were surveyed; projects, tools and academic work were reviewed. The result is a sober list of deficits – in tools, standards, training, cooperation with manufacturers, and in the handling of artificial intelligence.

One could file the report under "government matters". That would be a mistake. Almost every gap Europol describes for police and prosecutors exists in mid-sized companies in larger form – only without anyone writing it down. And unlike an investigating authority, a company decides for itself whether to close those gaps before an incident or to explain them afterwards.

Five findings from the report, and what they mean for you.

1. The chain of custody is still kept by hand.

Europol finds that the record of who took over, copied, analysed and passed on an exhibit, and when, is in practice kept largely manually – with the corresponding risk of gaps and error. The more parties involved, the weaker the chain: first responder, laboratory, investigator, prosecutor, cloud provider.

In a company the chain usually does not exist at all. An administrator notices the incident, logs on to the system, has a look, reboots, restores a backup. Every one of those steps is understandable and every one destroys evidence. When insurer, regulator or labour court later ask what happened, there is a narrative but no proof.

That is not a reproach to administrators. It is the consequence of missing preparation. What is needed fits on one page: do not switch off, do not log in, disconnect from the network, note the time, call forensics. Europol names exactly this group – first responders – as the largest knowledge gap and recommends short instructions, deliverable online, rather than training courses.

2. Cloud and IoT break the standards.

The applicable standards for digital evidence, ISO/IEC 27037 for acquisition and ISO/IEC 27042 for analysis, date from a time when evidence sat on hard drives. The report states the gap plainly: in cloud environments the investigator controls neither hardware nor deletion periods, a complete image is impossible, infrastructure logs are out of reach, and acquisition depends on the cooperation of a provider in another jurisdiction. Connected devices – from the security camera to the industrial controller – lack forensic interfaces altogether; data sits with the manufacturer and is overwritten after a short time.

For companies this means that the question of which logs your cloud provider retains, for how long, and how you export them must be answered before the incident. Afterwards it answers itself, with "too short" and "not at all". For operators of production and utility plant, passive network monitoring is frequently the only source of traces that does not depend on the device manufacturer. Whoever runs OT without capturing traffic has nothing when it matters.

3. Tools are used but not tested.

Europol describes validation practice that differs from country to country and at times from unit to unit, and calls for a central European testing body for forensic tools. The report also mentions proceedings in France that were dismissed because outputs of commercial analysis tools could not be correctly interpreted and substantiated. The users had trusted the tools without understanding them.

The same pattern shows up with providers called in after an incident: a report full of screenshots, with no tools, versions or methods stated, no hash values, no way to reproduce the result. Such a report helps with the clean-up. In court, with the insurer or in an internal-control audit it is worthless.

Ask your forensic provider three things before engagement: which tools do you use and how do you validate them? In what format do I receive raw data and results? Can a second examiner reproduce your result from the same data? Whoever dodges these delivers narratives.

4. Dependence on non-European tools is a risk.

According to the report, European vendors hold only a small share of the forensic tool market. In cryptocurrency transaction analysis – relevant after every ransomware payment – US companies dominate; historical data sits partly with a single provider, and licence costs are rising so steeply that agencies are cancelling subscriptions. Proprietary output formats prevent results from being exchanged between tools. Europol calls it a sovereignty problem: sensitive investigative data resides with companies outside the EU.

That diagnosis applies one-to-one to corporate IT. The choice of tool decides who sees your incident data, in what format you get it back, and whether you can still access it in five years. The report sets open-source tools against this – The Sleuth Kit, Autopsy, Volatility, Wireshark – whose methods are open and whose results are therefore explainable. That NEOSEC has relied on an open tool stack for years has exactly this reason: what we write in a report, we can derive.

5. AI may assist, but not decide.

The report devotes a chapter to the use of artificial intelligence and sets two chains side by side. The uncontrolled one: evidence, AI analysis, black box, non-auditable output. The controlled one: evidence, AI analysis, logged actions, human verification, documented result, report. Only the second is usable. Europol puts the benchmark plainly: a result with 99 per cent accuracy is unusable if the steps behind it cannot be shown. Forensics rests on repeatability, AI on probability – the two combine only if every AI action is logged, source data remains unaltered and a human takes responsibility for the result.

This goes beyond forensics. Auditors place the same demand on AI-assisted controls in an internal control system, and the AI Act places it on every deployer. Whoever uses AI for alert triage in a SOC – we do – must be able to show which alert was downgraded and why. An AI that silently discards alerts is not relief; it is an unlogged decision.

What the report says between the lines.

Europol describes authorities with budget, legal mandate and specialist staff that nonetheless fail at standardisation, validation and provability. A mid-sized company has less of all three and faces the same questions after an incident – with the difference that it must meet NIS2 reporting deadlines of 24 and 72 hours, prove the cause to an insurer and show auditors that its controls worked.

The good news is that the answer lies not in better tools after the incident but in preparation before it. Concretely:

All of this is a management decision, not an IT decision. IT can log if it is allowed to, and select providers if it is told to. Whether a company has evidence or memories after an incident was decided beforehand.