Digital forensic intelligence for illicit drug analysis in forensic investigations

Summary

In forensic investigations, forensic intelligence is required for illicit drug profiling in order to allow police officers and law enforcements to recognize crime developments and adjust their actions. In the present paper, we propose a novel framework for Digital Forensic Drug Intelligence (DFDI) by fusing digital forensic and drug profiling data through intelligent cycles, where a targeted and iterative collection of evidence from diverse sources is a core step in the process of drug profiling. Drug profiling data combined with digital data from seized devices collected, examined, and analyzed will allow authorities to generate valuable information about illicit drug trafficking routes and manufacturing. Such data can be stored in seized illicit drug databases to build in an intelligent way, all findings, hypotheses and recommendations, allowing law enforcement to make decisions. Our framework will potentially provide a better understanding of profiling, trafficking and distribution of illicit drugs.

Graphical abstract

Chemistry; Forensic toxicology; Computer science; Data analysis

Introduction

According to the World Drug Report 2023, 36 million people had used amphetamines, 22 million had used cocaine, 20 million had used “ecstasy”-type substances and 60 million people engaged in non-medical opioid use in 2021, of whom 31.5 million used opiates, mostly heroin.¹ After several years of steadiness, the number of new psychoactive substances (NPS) on the global market increased in 2021. Out of 618 NPS reported to be on the global market in 2021, 87 were recently identified.¹ Additionally, as per the world drug report 2023, the market for “Captagon”, an illicitly manufactured tablet commonly containing different concentrations of amphetamine, continues to grow in the Near and Middle East. In parallel, a methamphetamine market is developing in the Near and Middle East shown through an increase in seizures of the drug.¹

Furthermore, illicit drug trade continues to hold back economic and social development, and constitutes a fundamental threat to security and stability in some parts of the world.² In 2019, the most significant market growth was in synthetic drugs, mainly synthetic NPS, opioids (semisynthetic or synthetic opioids) and Amphetamine-Type Stimulants (ATS). Khat (seized in Arabian Peninsula, North America, Europe, and Africa) was the most seized plant-based NPS, followed by kratom found in Malaysia and Thailand, then ayahuasca, kava and Salvia divinorum in descending order.²

During Covid-19 pandemic, illicit drug markets were resilient. Traffickers adapted to the pandemic context by changing their modes of transportation and trafficking. Since drug trafficking by air was entirely disrupted by restrictions imposed on air travel, there was an increase use of maritime routes to traffic heroin to Europe.³ However, large shipments of cocaine were still traded by alternative means, such as direct cocaine shipments by sea cargo from South America to Europe.

Different countries investigated the pandemic’s effects on shaping illicit drugs’ markets. For instance, police officers in England inspected the effects of coronavirus and social isolation on Britain’s profitable street heroin and crack trade.⁴ Police officers observed that during the Covid-19 pandemic, dealers were highly functional, wearing supermarket, parcel delivery employee uniforms or even food delivery motorcyclists and, in some cases, nurses as camouflage not to be questioned.⁵ Previously, in Australia, illicit drugs such as heroin, cocaine, methamphetamine and 3,4-Methylenedioxymethamphetamine (MDMA) were usually seized at the border via air transport (85–99% of seizure numbers for drugs). However, with the pandemic and reduced air travel markets, demand moved toward other transported, inexpensive and advanced substitutes for heroin or diluted drugs with different and possibly hazardous chemicals.⁶

Looking at all the new approaches in illicit drug trafficking mentioned above, law enforcement faces several challenges related to illicit drug seizures. Thus, the implementation of novel methodologies is needed to prevent crimes related to illicit drugs and identify suspects involved in illicit drug manufacturing and trafficking.

This paper firstly presents an overview of traditional process followed for seized illicit drugs profiling and discusses the information sought by traditional analysis, expected results and limitations. Following, we advocate the intelligent use of forensic data, different types of forensic intelligence and the application of forensic intelligence for drug profiling in different countries. Additionally, we highlight different steps in digital forensic investigations. Lastly, we propose a DFDI framework by fusing digital forensics and drug profiling data through intelligent cycles.

Physical and chemical illicit drug profiling

Drug profiling is recognized as “the extraction of a drug sample’s chemical and physical profile, to be used in the application of policies against the illegal use of drugs (law enforcement, legislation, public health)”.⁷ Generally, chemical profiling provides evidence about the illicit substance along with adulterants, diluents, precursors, by-products, impurities and solvents.⁸ In contrast, physical profiling of drugs includes packaging and appearance of a drug, thus adding complementary information to chemical profiles.⁸

As illustrated in Figure 1, when illicit drugs are seized, crime scene officers start their analysis with presumptive tests, including indexing, photography, description and preliminary tests.⁹

Figure 1.

Representation of illicit drug profiling process (adapted from Morelato et al., 2013)

Illicit drugs seized are subject to presumptive testing and physical and chemical profiling following various techniques. Copyright 2023, Elsevier. Copyright Clearance Center License 5572430958016.

Following this, illicit drug profiling process combines physical profiling and chemical profiling. Generally, a correlation can be established between profiling data related to organic composition and physical characteristics. This was the case of seized MDMA tablets profiling where post-tabletting physical characteristics and pre-tabletting organic characteristics were relevant alone and combined together providing data about MDMA production and trafficking.¹⁰

Typically, due to the ease and accessibility of visual features, a visual inspection of a specimen is performed before any chemical analysis. This visual inspection allows seizures’ sub-categorization depending on color, texture, score/logo presence, shape, measurements, or general appearance. Score/logo and tablet measurements are machine-dependent and persist between batches, allowing seizures' linkage.¹¹ Additionally, a nearby examination of packaging material may conclude links among chemically distinct seizures providing some understanding of how criminals arrange their goods for transport.

To generate chemical drug profiles, forensic chemists have the choice between several analytical techniques depending on the scope of analysis and the sample’s characteristics. Since our manuscript focuses on digital forensic intelligence and drug profiling, we will briefly mention some analytical techniques commonly applied for illicit drug chemical profiling. Among these, for inorganic profiling, inductively coupled plasma mass spectrometry (ICP-MS) offers an elemental profile of numerous illicit drugs comprising ATS, cocaine and heroin, thus revealing information regarding a drug’s origin and synthesis route.^12,13 For organic profiling, gas chromatography-mass spectrometry (GC-MS), the gold standard for illicit drug profiling, and gas chromatography-flame ionization detection (GC-FID) detect manufacturing by-products providing evidence on trafficking paths, supply origin and link seizures.^14,15,16 Adulterants and diluent analysis can also be carried out by GC-MS and Fourier-transform infrared spectroscopy (FTIR).¹⁷ Moreover, ultra high-performance liquid chromatography (UHPLC), liquid chromatography-mass spectrometry (LC-MS or MS-MS) and isotope ratio mass spectrometry (IRMS) are considered as powerful tools in forensic investigations regarding drug profiling and determination of illicit drug’s origin.^{8,18,19,20,21,22} UHPLC is specifically suitable for heroin profiling where impurities as low as 0.02% could be detected allowing the determination of a heroin sample’s origin.²³ Through LC-MS, data on the origin of ephedrine and pseudoephedrine, precursors of MDMA, could be identified.²⁴ Furthermore, IRMS profile reflects the plants’ environmental and growth conditions of natural illicit drugs collected from plants providing information about illicit drug’ origin.²⁵ Through analysis of carbon and nitrogen isotopes of seized samples of marijuana, researchers could identify links between provinces in Brazil.²⁵

As discussed, traditional drug profiling requires numerous analytical systems, and the entire analysis procedure is usually expensive and time-consuming.⁸ Additionally, forensic drug experts may face several challenges related to the chemical or analytical aspects. Therefore, the approaches followed to extract features are fundamental for handling and contextualizing drug profiling information.

Forensic intelligence – The intelligent use of forensic data

Intelligence cycle is the process of converting raw information into finished intelligence applicable for policy makers and law enforcement in building judgements.²⁶ As showed in Figure 2, intelligence cycle includes several steps from data collection, evaluation, collation, analysis, dissemination to re-evaluation.⁹

Figure 2.

Intelligence cycle

The cycle begins with collecting traces or patterns transferred during an event of crime and ends with re-evaluation.⁹ Copyright 2023, Elsevier. Copyright Clearance Center License 5572430958016.

This cycle starts with the collection of illicit drugs and ends with re-evaluation. Indeed, data can be collected from many sources (crime scenes, witnesses, and reports) then examined and evaluated in order to determine its validity and reliability and converts into information. Following, information is combined and connected to existing information already recorded and stored. The structured collection of information is continuously analyzed to add value, detect new patterns and test hypotheses. This phase is critical and its results add value to information, called intelligence.⁹ Certainly, intelligence is only helpful if it is communicated promptly to decision-makers in the organization. Finally, data must be continuously updated, and intelligence must be examined to determine its effectiveness. This includes feedback and continuous updates of memory.

Indeed, intelligence is a common concept applied in many areas, and forensic science is one of them. As defined by several researchers, forensic intelligence is 'the correct, timely, and utilizable product of logically processing forensic case data for investigation and/or intelligence objectives’.^27,28 It plays a significant role in forensic science by transitioning from a case-by-case method to a more holistic and proactive methodology.²⁸

For law enforcement and police, forensic intelligence’s primary purpose is to link data to acquire a complete illustration of recurring criminal actions and stop a criminal from committing further crimes.²⁹ Indeed, Cartier illustrated the procedure of forensic intelligence from data/trace to information/sign until intelligence.²⁹ Data itself does not have any value and may be masked by other conflicting or interrupting data points. By extracting pertinent facts for analysis, these raw data are selected, processed, and converted into evidence that may reconstruct a case or identify possible connections between instances to detect potential links between seizures. Based on Cartier’s illustration, intelligence’s results yield to logical, significant, timely and accurate conclusions.²⁹ As illustrated in Figure 3, in policing, three types of forensic intelligence can be recognized, including tactical, operational, and strategic intelligence.³⁰

Figure 3.

Types of forensic intelligence (adapted from Marclay 2014)

Forensic intelligence can be classified as tactical, operational or strategic depending on the background in which it is applied. No copyright clearance needed.

Tactical intelligence (reactive micro-level of forensic intelligence) supports frontline enforcement officers to decide on special cases and is relevant to thorough investigations. In contrast, operational intelligence (meso-level) supports crime’s decrease and decision-makers responsible for geographical areas.³¹ The third type of forensic intelligence is the strategic one at a proactive global level, which offers a comprehension of patterns and operations of criminal behavior. Indeed, strategic intelligence is future-oriented and examines long-term solutions.

All stated types of forensic intelligence can integrate illicit drug profiling’s results to offer insights into networks of illicit drugs, production process and origin. For example, connections between several seizures can be established at an operational level, including illicit drug specimens with the same physical and/or chemical profiles. In addition, at a strategic level, several connections may identify the transportation trends, circulation network or manufacturing route on national and international levels.

Despite all that was mentioned, Ribaux et al., 2006, argued the contribution of intelligence in forensic science and initiated an intensive modeling program starting with a ‘bottom-up’ approach and ending with the identification of valuable primitive inference entities (forensic conclusions such as a DNA profile or a suspect’s confirmed visual description).Such entities can be identified and integrated into special procedures of serial crime analysis to generate valuable and timely intelligence.²⁷

Lastly, the integrity of forensic intelligence throughout investigation should be established. Hence, the viability of forensic intelligence production as well as its legitimacy and admissibility should be given critical attention.³² Regarding viability, warranting harmonious technical structures and methods is essential: data and intelligence should be intelligible to individuals receiving data and acting in addition to be free of error (false positive or negative). To ensure its legitimacy, there should be no doubt about the instruments that created forensic intelligence. Additionally, data’s exchange should be legitimately binding and convincing. Finally, for forensic intelligence’s admissibility, securing and preserving trust in the institutions in charge of creating forensic intelligence and exchanging it with respect for human rights is essential.³²

Forensic intelligence drug profiling among countries

Several official international entities aim to develop the forensic examination of seized illicit drugs. Among these, since 1997, the Scientific Working Group for the Analysis of Seized Drugs (SWGDRUG) has been dedicated for improving the practical recommendations for the examination of seized drugs.³³

Illicit drug profiling differs between countries and organizations. For example, in Australia, Australian Federal Police (AFP) is the organization handling the import or export of illicit drugs seized across Australian borders.³⁴ More recently, AFP seized 130 kg of cocaine, worth $40 million, from a cargo ship at Sydney’s port.³⁵ Generally, Drugs’ type and purity are determined through analysis to investigate whether seized drugs at Australian borders are illegal. Based on AFP regulations, different drug characteristics are determined, including size, weight, color, logo, organic and inorganic impurities and adulterants. Altogether, these extracted features constitute a drug profile, providing information about the manufacturer, the distribution process, and the market’s size. These profiles are incorporated into a database and compared to existing profiles in AFP to define relations among samples. Next, data can be interpreted in the circumstance of existing crime to acquire conclusive intelligence affecting illicit drugs’ trade.³⁶ As an example of forensic intelligence for drug profiling, Morelato et al. examined the chemical profiling of MDMA. They realized a match between a related sample (inside seizures) and unrelated samples (among diverse seizures) using correlation coefficients.³⁷ Links among seizures were detected using GC-MS, a crucial technique for operational intelligence purposes.

On the other hand, in Europe, illicit drug trafficking is more complex since it requires cross-border approaches with various jurisdictions. It can also be related to illicit drugs’ nature. Several European projects were concerned with drug profiling. Among these, the European project “Collaborative Harmonization of Methods for Profiling of Amphetamine Type Stimulants (CHAMP)” was the first cross-border approach to enable drug seizure profiling without samples moving between laboratories.³⁸ The project incorporated the synchronization of MDMA profiling approaches and allowed the establishment of a mutual database in a drug intelligence perception around Europe.³⁸ Another European project involved in the assemblage and interchange of illicit drug profiling data between several nations is the European Drugs Profiling System (EDPS).³⁷

Moreover, in Switzerland, illegal drugs are analyzed in different laboratories without having a centralized laboratory leading to a lack of harmonization since every laboratory has its own infrastructure and sample analysis requested by investigating magistrates.³⁹ Hence, comparing illicit drug profiling between different cantons is impossible since each laboratory possesses its own drug profiling process, analytical methods, database and management. Furthermore, a profiling method was established at the Institute of Forensic Science (IPS) at the University of Lausanne. Drugs held in the cantons of Geneva, Vaud, Neuchâtel, Jura and Tessin by Federal Criminal Police and Lausanne city police are analyzed in IPS laboratories.³⁹ The process emphasizes a practical methodology for drug investigation by law enforcement authorities. This analytical, statistical, and computerized approach could identify links between drug samples seized in different regional markets. Since categories of illicit drugs trafficked and itineraries followed are continuously developing, countries must work together in a combined and harmonized approach. In 2018, INTERPOL launched its Drugs Analysis File (DAF). With 114 participating countries, it is the broadest Analysis File of INTERPOL, gathering a significant volume of intelligence on illicit regional and international drug trafficking.⁴⁰ Through this drug database, INTERPOL can establish links between suspects, locations, substances and routes, enabling sharing of results in complete analytical products with all participating countries. In addition, INTERPOL’s activities are undertaken under the frame of INTERPOL’s Project AMEAP, an international project reinforced by the United Arab Emirates and INTERPOL Foundation for a Safer World. The project allows national establishments to recognize security threats and attack organized crime groups engaged in illicit drug trafficking in the mentioned area. The project also supports and reinforces collaboration and interchange of drug-related intelligence between organizations, allowing countries to profit from international police databases, thus improving investigations’ success and prosecution.⁴⁰

Another interesting drug intelligence approach when dealing with certain intelligence matters, is through the use of open-source intelligence (OSINT). This approach employs public data in the process of generating forensic intelligence. For example, ecstasy users’ reports can be extracted through application of the OSINT approach allowing the monitoring of drug trends in real time.⁴¹ Furthermore, patterns of flows of cocaine through United States are recognized via open-source price records.⁴² In other instances, human intelligence (HUMINT), through intelligence’ collection, is another approach that can be used to deal with the threat of international organized crime and drug trafficking.⁴³

Digital forensic investigation

In this paper, we suggested a new emerging unique approach of coupling digital forensic investigation and forensic intelligence of illicit drug profiling is essential in forensic investigations of seized illicit drugs. Hence, in this section, we discussed the general steps involved in digital forensic investigation, as illustrated in Figure 4.

Figure 4.

Representation of digital forensics investigation process (adapted from Yusof et al., 2011)

Digital forensic investigation begins with the identification of a crime or event and ends with the presentation. No copyright clearance needed.

In case of illicit drug seizures, some seized evidence includes digital evidence items such as mobile phones, computers, hard drives, flash drives, memory cards, cloud sources, etc., which can be identified and preserved while maintaining the chain of custody of physical and digital artifacts. Following a legal authorization for initial collection, digital evidence items are examined to extract data via the application of several digital forensic tools.⁴⁴ As a result, numerous manageable forms of data are obtained throughout the examination phase. These include filtering techniques, pattern matching and hidden data extraction.⁴⁴ Frequently, examining illicit drug cases will spot other digital evidence such as contact lists, social media communications, internet-browsing records, SMS, photos, videos, voice messages, bank transactions, geolocation shares, etc.

After examination, analysis of extracted information is realized through relational, functional or temporal analysis. Practically, forensic experts rely on multiple data visualization tools to facilitate the analysis of structured and unstructured data. Cellebrite Pathfinder (Figure 5) and Oxygen (Figure 6) are examples of common tools that allow data visualization by implementing artificial intelligence (AI), data mining and machine learning.^45,46 At this stage, the profile findings of illicit drugs will be inserted to discover the connections of events, locations, and relationships in order to compare and correlate between different suspects from a single or different case with multiple evidence items. Furthermore, analyzing these data allows the reconstruction of past events and predicts plausible outcomes and crimes connected to illicit drugs. Moreover, identification and tracking of criminals involved in illicit drug manufacturing and trafficking are possible through chasing digital money trails.

Figure 5.

Cellebrite Pathfinder

Investigators are challenged with massive volumes of data and digital evidence that necessitate filtering and analyzing. Cellebrite Pathfinder advances the investigation by means of AI to identify significant leads so that cases can be resolved quickly and more efficiently.⁴⁵

Figure 6.

Oxygen forensic detective data analytics

In-depth analysis of communications, including all contacts, phone numbers, overall number of communications as well as their total duration and period, are achieved through oxygen forensic detective data analytics software.⁴⁶

The final step of digital forensic investigation is presenting where digital data should be reported. This report must include the extracted information related to the identification of the drugs’ country of origin (photos, videos, SMS, etc …), the clandestine laboratory where these drugs were synthesized, and the methodology followed for drugs preparation in case recipes or photos are found in digital devices. Additionally, people involved in the drug supply chain, including the producer, trafficker, distributor, supplier, and user, can be identified through digital forensic investigation.

Perspectives-framework for digital forensic intelligence and drug profiling

Generally, intelligence and information accessible to be extracted from digital forensic data holdings are known as Digital Forensic Intelligence (DFI). DFI’s primary goal is to exchange approaches, thus improving efficiency and intelligent policing.⁴⁷

When conducting forensic investigations, it is critical to distinguish between digital evidence (DE) and digital forensic intelligence (DFI). Indeed, digital evidence is a reactionary examination of what happened at a previous time, whereas digital forensic intelligence is a procedure of forward-viewing analysis to predict what might happen in future based on information retrieved from previous actions.

In digital forensic examinations, intelligence’s application occurs at numerous levels of investigation, including the collection and preservation of digital evidence along with evidential integrity and continuity, analysis and presentation of digital evidence.⁴⁸ In addition, this intelligence is a beneficial tool for forensic examiners to report complex matters and speed the entire process by identifying appropriate sections for examination and eliminating results that are less expected to occur.⁴⁸

In the present paper, in the context of illicit drug investigations, we suggested a new perspective of developing a DFDI framework, as illustrated in Figure 7.

Figure 7.

Fusion of digital forensic investigation and drug profiling data

Drug profiling is realized in parallel to digital forensic investigation following the basic steps of identification, preservation, collection, examination, analysis and reporting. These validated data are then fused to generate evidence, presentations including a summary of key results (digital and drug profiling), a comprehensive report and a factual basis for conclusions.

Indeed, we introduced for the first time the term ‘DFDI’ as the procedure of automated intelligent scanning of digital forensic data from devices to extract information related to illicit drugs, specifically when it comes to drug production, trafficking and distribution. However, the type of criminal target to investigate should be well defined before employing DFDI because the type of drug profiling case can significantly affect the analysis outcome. For example, if law enforcement is chasing smuggling routes, the analysis should focus on large-scale drug seizures to avoid drug samples diluted by local dealers. Consequently, the drug profile can strongly correlate to certain criminal groups responsible for smuggling illicit substances into the designed country. On the other hand, analysis of seizures from local distributors may provide valuable data for targeting suspected local clandestine laboratories.

As shown in Figure 7, DFDI begins with a digital forensic investigation conducted based on the main steps explained in previous section ‘Digital forensic investigation’.

In parallel to digital forensic investigation, drug profiling is conducted where an initial collection step allows the classification of drugs of abuse based on their physical and chemical characteristics. Next, the visual examination of drug samples focuses on significant drug seizures and/or clandestine laboratory cases. Following, the instrumental analysis of drugs of abuse, as previously explained, is used to categorize each drug into multiple types depending on drugs’ content.

This step will be followed by a fusion of data reported from digital forensic investigation with those conveyed from drug profiling and external resources. Certainly, this fusion consists of validating data based on drug profiling and re-evaluating data established on fusion with external databases. Furthermore, this step opens the door to a deeper analysis of linked data and conveys more insights into a global context. Findings further trigger a targeted data collection based on identified events. Additionally, an iterative approach of analysis refinement cycles might be conducted where the suspect data are re-examined and evaluated for other elements. The last step consists of evidence generation and presentations, including a summary of key results (digital and drug profiling), a comprehensive report and a factual basis for conclusions. At an international level, different countries adopt diverse processes for evidence generation and presentation. Therefore, we suggest that each country applies its rules and constraints for last step’ execution. Finally, a decisive conclusion can be achieved based on the framework we are suggesting through establishing a link between the hypothesized and real data.

Discussion

As mentioned earlier, over the past years, illicit drug analysis has focused mainly on harmonizing analytical techniques, including emerging instrumentations that provide untapped data.⁸ Nevertheless, little is known about the way extracted information from illicit drug profiling is exchanged between laboratories and end users (illicit drug investigators and prosecutors). An additional challenge concerns the way these extracted data are integrated within a criminal justice system, especially in an international context of illicit drug trafficking.

In the present paper, we have first overviewed briefly the traditional physical and chemical illicit drug profiling in a forensic context. Drugs with similar profiles can be different regarding the chain of production, trafficking pathway, supply and market distribution. Consequently, introducing new approaches for illicit drug profiling is required, and forensic intelligence application in this context is one efficient approach.⁴⁹

We discussed the forensic intelligence and its application in illicit drug investigations where the systematic linkage of illicit substances through their physical and/or chemical profiles could be associated with cases that were previously the object of separate investigations. Indeed, each new specimen is compared with existing data in an intelligence cycle and organized in a memory built upon earlier seizures or known origin ref.⁵⁰

When processing illicit drug seizures for forensic intelligence purposes, several challenges should be addressed. Among these, the decision of data to be collected and the ability to profile drugs and store this information promptly are the main ones. Thus, for the first time, we suggested integrating an intelligence cycle for digital data processing and an intelligence cycle for drug profiling called DFDI, as presented in Figure 8. Indeed, in some illicit drug seizures, digital evidence is collected for further analysis through intelligence cycles alongside drugs. As revealed earlier, to enable data analysis, forensic experts use diverse tools integrating AI and machine learning.

Figure 8.

Digital Forensic Drug Intelligence (DFDI)

The intelligence cycles for digital data processing and drug profiling are merged.

More importantly, before implementing our suggested DFDI framework within police and law enforcement, the type of criminal target of the investigation should be well defined since this step can affect the analysis’ conclusions. Through DFDI application, police can potentially gain detailed knowledge about the structure, manufacturing processes and organization of drug trafficking and organized crime groups. In addition, the geographical source of seizures can be determined through the extraction of locations where pictures of drugs were taken, and the operating clandestine laboratory can also be monitored. Moreover, appropriate information can be gathered to generate national and international drug databases allowing the monitoring of national and international drug trafficking in a timely and cost-effective manner. Furthermore, a better understanding of drug networks, user networks and dealer identification can be established.

We estimate that the suggested framework allows crime’s disruption and prevention through early identification of suspects and more effective use of forensic traces that may inform policing. Besides, it may have several tangible benefits of related intelligence products such as threat assessments, situation reports and risk assessments.

By applying DFDI, there is a chance to answer the interrogations of strategic, tactical, and operational intelligence and investigation requirements associated with illicit drug profiling and trafficking. DFDI may also allow a better understanding of the criminal activity in focus as a whole.

Since international illicit drug trafficking and markets are constantly developing, international collaborations are needed through combined and harmonized approaches in order to identify security threats organized by criminals who are engaged in illicit drug trafficking. Moreover, interchange of drug-related intelligence between organizations would allow countries to profit from international police databases. This ultimately improves the success of the investigation and prosecution of illicit drug manufacturers/traffickers. This interchange of drug-related intelligence targets the full range of stakeholders involved, including forensic scientists, investigators, intelligence officers, managers and decision-makers.

In summary, it is essential to deploy and test the proposed framework on real data. Some Algorithms may possibly be applied in the future to present our framework following AI guidelines.

Framework source selection

The majority of information included in the perspective was directly obtained from official website (such as UNODC, US Department of Justice, etc.) and peer-reviewed journals (such as Forensic Science International journal, Egyptian Journal of Forensic Science journal, etc.). Fifty references covering years 2000–2023 with 36 peer-reviewed papers were included based on several factors including publisher, content and authors pioneers in the field of illicit drug analysis, digital forensic and forensic intelligence. The proposed framework is unique in comparison to those recommended by Morelato et al., 2013; Morelato et al., 2014 and timely through the suggestion of a DFDI framework by fusing digital forensics and drug profiling data via intelligent cycles.