Special Report | Computer forensics: The new DNA

Within a week of discovering computer equipment in the bombed-out safehouse of slain terrorist Abu Musab al-Zarqawi, U.S. and Iraqi forces carried out more than 450 raids targeting followers of al-Qaida's leader in Iraq.The vital information that led to the military action came from the Defense Department's growing ability to uncover and comprehend information stored on everything from disk drives and cell phones to personal digital assistants and Global Positioning System equipment.'We have the capability, and do pretty sophisticated forensic analysis for an array of things,' said Steven Shirley, executive director of DOD's Cyber Crime Center.Shirley declined to comment on the Zarqawi case, but said, 'we are the partner for the National Media Exploitation Center,' the National Security Agency's analysis program for documents and data seized in Iraq, Afghanistan and other locales. 'We have a very sophisticated capability for high-speed turns on high-priority things.'While the Zarqawi example is but one high-profile success, DC3, as it's called, is leading the federal effort to apply IT forensics more consistently across the government in response to intrusions, crimes and other cyberthreats.'I believe DC3 is going to be the center of gravity within DOD on cyberforensics,' Shirley said at an industry briefing last month. 'There are approximately 5,000 agents working in Defense crime and counterintelligence, [but only] about 150 agents doing cyberinvestigations.' The vast majority of them work at the center.The forensics field is growing, thanks in part to DC3's success in salvaging information from recovered hardware, even if bombings or gunfire have damaged it.'Digital forensics is a nascent field, in a vertical climb,' Shirley said, comparing it to the development of DNA evidence as an important and scientifically valid field.The federal effort is not limited to DOD: The FBI, Secret Service, State Department and the intelligence agencies, among others, also have set up in-house labs around the country.Additionally, approximately 20,000 police departments are wrestling with everything from identity theft to financial fraud via computer to electronic stalking.The International Association of Chiefs of Police of Alexandria, Va., one of the largest organizations for professional law enforcement, has formed a new committee on computer crimes and digital evidence.And accounting firms, law firms, even large corporations are expanding their use of computer forensics tools.Brent Pack spent 20 years in the Army, 16 of them with Army's counterintelligence division, including the last seven with its computer crime investigative unit.After retiring from the service, he joined Target Corp. of Minneapolis, heading up its corporate investigations and forensic services unit.There is no hard market research on the size of the government computer forensics market, but AccessData Corp. of Lindon, Utah, one of the leading forensic tool vendors, estimates today's computer forensics market for law enforcement at $100 million and the commercial market at $500 million, according to a report in Investor's Business Daily.Federal funding has not yet caught up with the field's growing importance, however. The Senate Appropriations Committee last month approved $175 million in funding for DNA testing programs, but just $18 million for forensics.Even with all this activity, DOD's computer forensics lab became the center of the department's cyberforensics efforts in 1998 as part of the Defense Reform Initiative. DOD officials formally created DC3 in 2001; from the beginning, it was one of the largest agencies dedicated to computer forensics in the world. Last year, DC3's laboratory received accreditation from the American Society of Crime Lab Directors.And even though the various counterintelligence agencies and all the military services have some in-house forensics capabilities, such as the Air Force Office of Special Investigations, Army Criminal Investigative Division and Naval Criminal Investigative Service, DC3 is the Pentagon's go-to source when there is a particularly complex forensics challenge.In fiscal 2005, the center closed 492 cases. Requests from Navy and Air Force offices accounted for more than 70 percent of the cases, Shirley said, and DC3 is on pace to break 500 this year.The center now employs 200 people, about 75 percent of them contractors. DC3 awarded General Dynamics Corp. a five-year, $20 million support contract for two of its three divisions in 2002, and the agency is making procurement plans for a successor contract by the end of the year.General Dynamics provides a wide range of support services, along with forensic-tool development and testing, said Jim Jaeger, business area manager for digital forensics systems and program manager for the DC3 forensics support contract.DC3 has three divisions, which provide one of the world's most comprehensive sources of digital-forensics capabilities.The Defense Computer Forensics Laboratory is the hands-on working group that dissects computer equipment submitted for analysis from all the services and the intelligence community. Shirley said 85 to 90 people work in DCFL; while the bulk of them are contractors, officers from the criminal investigative arms of the military services are detailed to the lab, as well.DCFL is one of about a dozen computer forensics facilities in the country that have been accredited by the American Society of Criminal Laboratory Directors-Laboratory Accreditation Board, the organization that sets standards for all crime labs. It is the largest accredited lab in the world, Shirley said; the next-largest lab to earn the accreditation is the FBI's regional forensics lab in North Texas, with only about 14 people.'It's an expensive proposition' to get accredited, Shirley said. He estimated that the process required an 18 percent to 35 percent 'bump' in overhead costs.But accreditation is worth the investment for DCFL because the laws regarding cyberevidence and what constitutes expert testimony still are evolving.Don Flynn, DC3's legal adviser, said the Supreme Court has ruled that scientific evidence is no longer restricted to 'that generally accepted.' Instead, it has to be determined on a case-by-case basis. So there are criteria that have to be applied when considering computer forensic evidence: Is it accurate'can other tools find the same evidence? Is it reliable'do the tools return the same result each time? And is the error rate zero'can the material be found on the evidence that was searched?Perhaps most important, can evidence be presented that proves a defendant knew the incriminating data was on his computer? Otherwise, Flynn said, it leads to the SODDI defense''Some other dude did it.'General Dynamics' Jaeger agrees that accreditation is going to become critical in the future. 'We've seen Texas pass a law that evidence presented in court has to be from an accredited lab. I think they had to back off it a little' because there just aren't enough of them, 'but I think you'll start seeing defense attorneys challenging results that aren't provided from an accredited lab.'A second component of DC3 is the Defense Cyber Crime Institute, which provides research, testing, development and evaluation of existing and new forensics tools. Its major customers include Defense forensics lab; the military law enforcement community; other DOD agencies including intelligence, counterintelligence and counterterrorism groups; the Homeland Security Department; and state and local law enforcement, said Edmund Kong, director of engineering and deputy director of DCCI.The third part of DC3 is the Defense Computer Investigations Training Program. It is a formal training program for forensic examiners, investigators, system administrators, and other DOD personnel with responsibility for protecting systems from unauthorized use, criminal and fraudulent activities, and foreign intelligence services' exploitation. DC3 awarded Computer Sciences Corp. a five-year support contract in 2002 for the training program.The program has course tracks in the basics of computer forensics, intrusions and network investigations, classes geared to first responders and continuing education to keep examiners' and investigators' skills sharp and bring them up to speed on new developments. DOD trains the students on the most widely used forensic tools now on the market.While the program is small, with just seven classrooms, it has trained more than 6,000 students to date, said Raymond Kessenick, director of DCITP, including 1,342 in 2005 alone.As more DOD agencies need computer forensics, Shirley and his staff have had to turn away requests for assistance because it was fully committed.The lab is very particular about the tools it uses as well. 'What you'll see in the lab [is] certainly not bleeding edge,' he said at the industry day, to stifled groans from some in attendance. 'We want something a bit more stable, that will perform more reliably, in accordance with test and validation.'While DC3 is inundated with requests for help, there are a number of long- and short-term challenges the office must overcome.The challenges range from the sophisticated to the extremely mundane: keeping on top of emerging digital technologies, tracking down the power cords and cables needed to keep myriad cell phones and PDAs charged, redesigning the building to manage the thermal load generated by hundreds of electronic devices.One of the biggest issues is data storage.'One intrusion that we worked on had 127 hard drives' that DCFL had to copy, analyze and retain, Shirley said.The lab currently has a storage area network from XioTech Corp. of Eden Prairie, Minn., that provides 100TB of space, said Tony Celeste, vice president and general manager of the company's government area. DCFL is in the process of upgrading to a SAN in excess of 200TB.'The industry is going to tiers of storage,' Celeste said. 'The things that are most critical'homeland security or counterterrorism, where how quickly you can obtain data [is the key]'that's solid-state. ... Then there's Fibre Channel drives, which is the next level of performance, all the way down to Massive Arrays of Idle Disks. That saves on power and cooling; [it's] more like archival tape systems.'There are SAN products that address DC3's long-term storage problem, but Shirley says vendors are missing another major need. 'We have requirements for a portable SAN,' he said.When investigators go to Iraq to reconstruct a damaged hard drive, they have to carry their storage capacity with them.'It needs to be air-transportable and [not] need an air conditioning plant, and it has to be ruggedized,' he said.Storage needs may seem prosaic compared to other areas that DC3 looks to address in the near future. Shirley's research list sounds like a 'greatest hits' of computer trends.'Peer-to-peer technologies, steganography, malicious code analysis, data recovery [from] damaged advanced media,' he ticks off. 'Data visualization and mining, metadata retrieval and analysis, videos and images retrieval and analysis, PKI and biometrics.'All are becoming potential sources of digital DNA for forensics specialists.