Kit puts digital forensics into the field

It is a digital world and let's pretend, for now, that you are a digital criminal.

Six months ago you were arrested on suspicion of a digital crime, and the police came and confiscated computing materials – personal computers, laptops, tablet, external hard drives, USB drives, smart phone, tablets. Into a box they all went and were sent off to the digital forensics lab to be studied to determine that you are guilty of a digital crime.

But, the forensics lab is backed up. The queue for your evidence is 40 weeks, maybe more, maybe less. So, you get out on bail, knowing that the forensics team will eventually get around to proving your guilt. The forensics process in the lab is expensive and time-consuming, and only one of the several dozen digital devices the police confiscated has anything incriminating on it.

“The examination of the computers can take up to 18 months in some cases, certainly around 10 months,” said Andrew Sheldon, managing director of Evidence Talks, a digital forensics consulting firm in the United Kingdom. “That is 10 months' worth of time that the suspect is out on the street and potentially aware that he is going to be found guilty and thinking that 'I might as well go do the big one.' ”

This is where Dell Computers and Evidence Talks think they can help, with a new portable digital forensics triage tool for police. It consists of a Linux operating system called Spektor deployed on Dell equipment called the Dell Mobile Forensics Unit.

Essentially, it is a forensics kit that can be deployed for investigators to triage digital devices in the field to determine which devices need to be sent to a forensics lab for analysis. The kit consists of a fully rugged (XTR) Dell laptop with a touch-screen interface, backlit keyboard, hard drive and compressor, and an array of connection tools that can process any type of device, as small as USB drives to desktops.

“If I could give a policeman a breathalyzer, he can then go and stop a suspected drunk driver and apply the breathalyzer in the sure knowledge that it will give him the knowledge on which he can make and intelligent and informed decision,” Sheldon said. “All the frontline officer needs to know is how to configure, how to deploy it and how to interpret the results. So, what we have developed is the digital forensic equivalent of a breathalyzer.”

With the exponential growth and ubiquity of computing devices, triage is becoming an important way for officers in the field to determine what is sent back to the labs and what is not necessary. There are many products in the digital forensics market that have the ability to do this, such as Knoppix, Helix and Microsoft’s Cofee, among others.

“A number of other organizations produce free triage tools, and in their place they work quite well, but they are designed for people that have some knowledge, some skill,” Sheldon said. ”That immediately reduces the amount of people on the front line who can use them.”

What Spektor tries to do is lower the bar for digital forensics triage to put less stress on laboratory queues and requirements of forensic officers.

“This technology, the mobile forensics solution, in the hands of a non-expert user like a frontline officer or a scene-of-crime officer or a solider on the front line, can be used to very quickly look at the contents of anything,” Sheldon said.

Homeland Security Secretary Janet Napolitano has asked for recommendations on how the U.S. government and its military can be prepared for information the instant it is needed. The Spektor triage tool is portable and easier to use than most other solutions, designed for a quick-in, quick-out capability.

“It is a touch-screen process that the user is driven through a controlled process,” Sheldon said. “So, basically, we are taking the skill of the forensic analysts and embedding it in a controlled process in a simple to use piece of equipment that they can use on the front line to make informed decisions about where the evidence might be. They can see the evidence, see the movies, the pictures, read the documents…and send it off for forensic analysis”

Criminal cases can be tricky. The primary battle fought in courtrooms are over evidence – what is to be admitted, whether it has been handled and stored properly, etc. Sheldon said that Spektor took the approach that the process is more important than the results. Spektor can be tracked, audited and authenticated, from the original first responder through the data chain to trial.

The system is just being deployed in the United States in Plant City, Fla., one of the first to implement it under the watch of detective Kent Andrel. Fifteen of the about 48 police organizations in the United Kingdom are using Spektor, with it being deployed to catch pedophiles and assist in raids of multi-occupants buildings where an investigation led to an IP address but not a specific computer.

“Almost everything has a digital footprint now," Sheldon said. "The important bit is to be able to preserve that digital footprint as part of an investigation. This doesn't avoid the need for forensic analysis. But it solves a really critical problem.”