You are an expert at summarizing long articles. Proceed to summarize the following text: 
continuous development of information communication technology and large scale proliferation is leading to an increase in victims of digital crime , as well as tools and evidence in criminal investigations [ 1 ] . many crimes , even traditionally non - digital crimes such as murder , now normally have some sort of digital component [ 2,3 ] . even so much so that some law enforcement agencies claim that there are rarely cases that do not involve some sort of digital device [ 4 ] . because of this , the ability of law enforcement to handle electronic evidence is vital during entire investigative procedure . a survey recently conducted by the united nations ( u.n . ) reported that more than 90% of respondent countries have at least some capability to conduct digital investigations [ 5 ] . however , the u.n . report also showed a global need for expansion of digital investigation capability . key areas of concern were with the investigation capabilities in less developed countries , as well as the capability of organizations to conduct international investigations . this mirrors huber [ 6 ] , who claimed that `` digital forensics is very much an interstate and international issue '' . general cybercrime investigation , computer forensics and digital evidence handling were the most commonly cited areas that require more development and assistance . currently , many public and private organizations around the world are investing in the infrastructure of developing countries . however , international assistance in regards to digital crime investigation has been slower that other sectors , such as information technology [ 7 ] . many countries , developing and developed alike , are beginning to invest in the capability of their investigators to investigate digital crimes . this has caused a rapid growth in the number of digital crime investigation programs offered at training institutions and universities around the world . these programs are targeted at improving an investigator s _ capability _ in dealing with certain types of digital crime ; however , improvement of capability does not necessarily improve investigation _ capacity_.    hekim , gul et al . [ 8 ] previously examined investigation capacity in law enforcement to assess whether information technology improves investigation capacity . in their work , they define investigation capacity as the case clearance rate . james and jang [ 9 ] , however , claim that the case clearance rate alone does not adequately represent an investigator or unit s investigation capacity . they instead define investigation capacity as case clearance rates as related to time , where : +    @xmath0    where :    * @xmath1 is the time span for which capacity should be measured    capability and capacity are related terms that have to do with quality . in investigations a highly capable investigator may be able to conduct quality investigations unless there are more investigation requests than he or she has the capacity to deal with at a time , at which point quality may be reduced . many investigators have to cope with a lack of resources [ 10 ] , meaning that they are normally working at  if not over  capacity . because of this , when attempting to educate investigators both expansion of capability and capacity should be considered and measured . this work proposes a holistic training development model  specifically focused on cybercrime investigation  that is based on improving investigator capability while also considering the capacity of the investigator or unit . along with a training development model , a cybercrime investigation capacity assessment framework is given for attempting to measure capacity throughout the education process . first , a training development model is proposed that focuses on the expansion of investigation capability as well as capacity of investigators and units . next , a capacity assessment model is given to evaluate the effectiveness of the training program . a description of how the proposed model is being applied to the development of training programs for cybercrime investigators in developing countries will then be given , as well as already observed challenges . finally , concluding remarks as well as proposed future work will be discussed . the growing number and complexity of digital devices related to criminal acts means that digital investigators must attempt to increase their knowledge of a broad range of technologies , as well as increase the pace at which such devices can be analyzed [ 11 ] . there are a number of challenges that digital investigators face , and education and training is a primary challenge for many investigation units today [ 7,10 ] . not only is receiving training sometimes a challenge , but the way training is organized and delivered can also cause issues . further , in many training programs the content may be such that investigators do nt  or ca nt  implement trained material in practical investigations . such a situation could be the product of a training program that did not meet the needs of the trainees ; however , without post - training assessment there is no way to know whether skills and knowledge are being transferred to practice . the korean national police , for example , are active contributors for building investigation capability and capacity with developing countries ; however , few development programs have adequately evaluated the effectiveness of such initiatives .    with many organizations , evaluation may be at the end of a training session and perhaps award the trainee a simple qualification upon completion . however , short term trainings do not necessarily lead to long - term knowledge gain , even if a trainee does well on an examination immediately after the course [ 7 ] . also , because no further evaluation is normally done , training organizations have no way of assessing if knowledge or skills have been practically transferred .    for the issues of generally targeting the training to the needs of the trainees , and ensuring that knowledge and skills are being practically transferred for the improvement of capability and capacity , this work proposes a holistic training development methodology to increase cybercrime investigation capability and capacity . as shown in figure [ fig : pdmdiagram ] , the method begins with an extensive assessment of the organization , attempting to determine what their goals , processes and current knowledge are . during the observation phase , a training group should gain understanding of the current state of knowledge and skills of the organization to be trained as well as how the organization can / will implement new knowledge . in our experience , it is common for the trainers to find that organizations to be trained are either already knowledgeable about many of the areas , or that the organization has no skills in the area and may require remediation . it is relatively uncommon to have a group , even within the same organization , in which all participants have the same level of knowledge and skills in a particular area .        once a better understanding of how the organization functions has been established , the needs of the organization should be determined . this stage should be approached with some skepticism as many organizations tend to have difficulty differentiating between wants and needs , and in some cases are simply ignorant of their actual needs . based on knowledge gained in the observation phase , paired with lists of the organization s needs , a training developer should attempt to assess identified needs in the context of the organization s goals and current practices . many organizations , for example , often identify ` more equipment ' as a need to expand capacity . capacity , however , can be expanded in many ways , such is more efficient processes . the training developer , then , should attempt to determine major problem areas at the national , organizational , divisional and personal levels , and evaluate what is needed to make a lasting positive impact on the organization . again considering more equipment as a example , additional equipment may make up for inefficient processes in the short - term , but will exacerbate inefficient processes as capacity again reaches its peak . once needs of the organization have been established , program development can begin . there are many course development strategies , but we tend to prefer the successive approximation model ( sam ) . sam is essentially a breadth first approach to curricula design , where the design is iterative  from general to specific  for approximately three iterations [ 12 ] . sam is composed of three specific phases : preparation , design and development .    * preparation * * information gathering * * * background information * * * needs analysis * interactive design * * iterate through the design , prototype and review phases * * `` savvy start '' * * project planning * * additional design * interactive development * * iterate through development , implementation and evaluation * * design proof * * alpha version * * beta version * * final ` gold ' version    sam is general and intuitive enough to be easily applied to many different areas . iteration in the development and design phases means that the developer can be more abstract and focus in once they have more information and feedback , rather than picking a design and sticking strictly with it . further , iterations of sam include an evaluation phase ensuring quality standards are maintained . in this case , sam is used for course design for the manager and train - the - trainer programs . as discussed , many training and education initiatives focus on the expansion of capabilities of investigators . however , to improve capability and capacity , management must also be involved . in the proposed model , management receives in - house training designed to suit the organization s identified needs . such training could focus on improving work flows , data management , evidence intake , etc . as can be seen by a work flow process analysis in [ 13 ] . once initial in - house training has been given , management is expected to form action plans that begin to apply what they have learned . created action plans should be practically implementable in their organization . implementation of new knowledge is assessed and supplemented via practical management on - site training . on - site training allows the trainer to better understand how  or if  the trainees are attempting to apply what was learned to improve processes in the organization . this also allows the trainer to help point out potential areas of improvement , and answer practical implementation questions with the organization as an example . the outputs of management training are crime management , investigation and prevention strategies that are beginning to be implemented . this includes management s , possibly newly created , goals for investigator training and investigation needs . training for investigators is developed in parallel with manager training , again using sam . the first content to be created for investigators is the e - learning component . e - learning allows busy organizations to complete some training at a time that is convenient for them . it also allows trainers to assess trainees current level of knowledge , and provide remedial education , if necessary . this will allow all participants to have a similar starting baseline knowledge , which is missing in many training programs . next , in - house training for investigators is developed around the previously identified needs , using the same themes as the management training . once , skills and knowledge for investigators have been developed , and practical feedback has been given from the management training , then investigators undergo domestic training that feeds directly into their investigation process . these processes continue , and are supplemented with on - site training . oftentimes when organizations receive training and education , trainees may make informal social network connections that may help in the application of learned skills and knowledge . however , this support may not be responsive , consistent , or the best suited for helping organizations . for this reason , online consultation with experts associated with the training organization is provided in this model . in this case , if trainees have questions , they can consult with experts in the knowledge domain rather than other practitioners that may also be learning these processes . with such support , the trainees may be more confident about attempting to develop and implement better investigation processes and techniques . the cybercrime investigation capacity assessment framework includes observation and assessment throughout the training program . observation of the organization is conducted before and after each training initiative for the whole organization .    the observation phase is composed of a survey of the organization to determine the basic level of skills and knowledge for the organization . this survey , along with knowledge about organization processes determined during the first observation phase give the training organization a baseline with witch to compare skills and knowledge development . after a training session has been delivered  either in - house or on - site  an assessment of the trainees is given to attempt to evaluate their short term understanding of the objectives . from three to six months after training has been received , the survey will again be administered to assess capability , and an assessment of changed processes will be conducted to evaluate efficiency improvements . finally , the previously described capacity measurement model [ 9 ] will be used to assess improvements in capacity over time .    by using a qualitative survey , an observation of process changes , and a quantitative approach to capacity assessment , greater understanding of how the organization s process has change , and what the effects of this change are in terms of capacity can be determined . this process has been developed in response to shortcomings observed in current cybercrime investigation training initiatives , especially in the area of assessment . the overall process is currently being applied to three ( 3 ) year cybercrime investigation capacity building programs for 5 asian countries . in many of these countries , such a project will be the first attempt to measure the countries cybercrime investigation capacity , and evaluate an organization s investigation process in relation with training . such an initiative , however , is only a first effort towards measuring the effects of training on cybercrime investigators . therefore the model , although currently general , is expected to be modified with experience . this is especially true from the cybercrime investigation capacity assessment framework as better metrics for metrics are identified . this work proposed a holistic training development model  specifically focused on cybercrime investigation  that is based on improving investigator capability while also considering the capacity of the investigator or unit . along with a training development model , a cybercrime investigation capacity assessment framework was given for attempting to assess investigation capability and capacity throughout the education process . such a model is proposed to a attempt to improve pre and post training assessment , as well as allowing training developers more information about the organization that will receive the training so such training can be better targeted , or remediation can take place before training begins if necessary .    as discussed previously , this development and assessment model is currently being applied to training programs with five asian countries . ideally this model will allow training developers to understand the individual needs of each country , but will result in a relatively generalized program that meets the needs of each group . future work will attempt to assess the weaknesses of each step of the model , especially with metrics used in the capacity assessment framework . casey , e. ( 2004 ) . digital evidence and computer crime : forensic science , computers and the internet ( 2nd ed . , pp . xviii , 690p . ) . amsterdam , london : elsevier academic . 2 .   rte . text message evidence in murder trial . rte news . retrieved from http://www.rte.ie/news/2010/0423/drimnagh.html 3 . nguyen , l. ( 2012 ) . tori stafford trial : cellphone record shows gap during abduction , murder . postmedia news . retrieved from http://www.canada.com + /life / tori+stafford+trial+cellphone+record+shows+during+abduction+ + murder/6486178/story.html 4 . philipp , j. ( 2013 ) . nearly every nyc crime involves cyber , says manhattan da . the epoch times . retrieved from http://www.theepochtimes.com + /n2/united - states / nearly - every - nyc - crime - involves - cyber - says - manhattan - da-355692.html 5 . \(2013 ) `` comprehensive study on cybercrime '' . united nations office on drugs and crime . http://www.unodc.org/documents/commissions + /ccpcj_session22/13 - 80699_ebook_2013_study_crp5.pdf 6 . huber , e. ( 2010 ) . certification , licensing , and accreditation in digital forensics . a fistful of dongles . retrieved from http://ericjhuber.blogspot.com + /2010/11/certification - licensing - and.html 7 . james , j. i. , & gladyshev , p. ( 2013 ) . challenges with automation in digital forensic investigations , 17 . computers and society . retrieved from http://arxiv.org/abs/1303.4498 8 . hekim , h. , gul , s. , & akcam , b. ( 2013 ) . police use of information technologies in criminal investigations . european scientific journal , 9(4 ) , 221 - 240 . retrieved from http://eujournal.org/index.php/esj/article/view/778 9 . james , j. i. , & jang , y. j. ( 2013 ) . measuring digital crime investigation capacity to guide international crime prevention strategies . unpublished paper in the 7th international symposium on digital forensics and information security . 10 . gogolin , g. ( 2010 ) . the digital crime tsunami . digital investigation , 7(1 - 2 ) , 3 - 8 . doi:10.1016/j.diin.2010.07.001 11 . casey , e. , ferraro , m. , & nguyen , l. ( 2009 ) . investigation delayed is justice denied : proposals for expediting forensic examinations of digital evidence . journal of forensic sciences , 54(6 ) , 1353?1364 . doi:10.1111/j.1556 - 4029.2009.01150.x 12 . allen , m. w. ( 2003 ) . michael allen s guide to e - learning : building interactive , fun , and effective learning programs for any company . wiley . 13 . james , j. i. , & gladyshev , p. ( 2013 ) . a survey of digital forensic investigator decision processes and measurement of decisions based on enhanced preview . digital investigation , 1 - 10 .
digital technologies are constantly changing , and with it criminals are finding new ways to abuse these technologies . 
 cybercrime investigators , then , must also keep their skills and knowledge up to date . 
 this work proposes a holistic training development model  specifically focused on cybercrime investigation  that is based on improving investigator capability while also considering the capacity of the investigator or unit . 
 along with a training development model , a cybercrime investigation capacity assessment framework is given for attempting to measure capacity throughout the education process . 
 first , a training development model is proposed that focuses on the expansion of investigation capability as well as capacity of investigators and units . 
 next , a capacity assessment model is given to evaluate the effectiveness of the training program . 
 a description of how the proposed model is being applied to the development of training programs for cybercrime investigators in developing countries will then be given , as well as already observed challenges . 
 finally , concluding remarks as well as proposed future work is discussed . 
 * keywords : * _ cybercrime investigation capacity assessment , cybercrime investigation capability , training development , education , law enforcement _