PUT AN END TO MOUNTING CASE BACKLOGS WITH BEST-PRACTICE DIGITAL FORENSIC WORKFLOWS

Transcription

1 NUIX AND ADF WHITE PAPER PUT AN END TO MOUNTING CASE BACKLOGS WITH BEST-PRACTICE DIGITAL FORENSIC WORKFLOWS Nuix s Paul Slater and ADF Solutions Harry Parsonage discuss a forensic workflow that combines both companies' industry-leading technologies to solve many pressing challenges for digital forensic investigators.

2 THE CHALLENGE The growing number of electronic devices containing potentially relevant digital evidence is putting increasing pressure on overworked investigators and budget-restricted law enforcement agencies. This growth is only projected to continue, and traditional methods for evaluating electronic evidence can t keep up as it is. Investigators face considerable difficulties from the shortcomings of many traditional forensic tools. These applications are often complicated to use and cannot process a sufficient volume of evidence per day to make it available for timely analysis. Yet, many investigators still analyze each data repository separately using traditional tools, then try to correlate manually the evidence they have uncovered. This time-consuming approach is seeing law enforcement and government agencies face mounting case backlogs. Evidence can also be held in enterprise systems, cloud, archive and mobile devices, which are often outside the capabilities of traditional forensic tools. As the quantity, variety and complexity of electronic devices continues to grow, the problem is only going to get worse. Many investigators still analyze each data repository separately using traditional tools, leading to mounting case backlogs A MORE EFFICIENT APPROACH Finding critical evidence faster and eliminating case backlogs requires a more efficient approach. In recent years, we have seen that when law enforcement and government investigators look beyond traditional methods, they can often achieve better results in less time. A more effective approach for the forensic lab involves assembling all available devices in a single location, then using a combination of triage, data management, analytical and forensic techniques to understand and analyze the content and context of the digital evidence. This makes it possible to focus rapidly on the most relevant evidence sources until the key facts emerge. ADF Solutions and Nuix recently joined forces to create a scalable solution and a workable triage workflow, which time-constrained and resource-limited investigators can easily follow to quickly process large volumes of data across a range of formats. First, ADF s capabilities allow investigators to rapidly analyze and triage large numbers of potential evidence sources including computers and flash storage media. The software identifies all potentially relevant evidence for indexing and detailed analysis in Nuix Investigator. Investigators can then process the selected devices, gather and cross-reference intelligence, analyze the evidence and conduct collaborative investigations with multiple investigators and subject matter experts. PAGE 2

3 THE WORKFLOW The workflow described in this paper allows the first responder to identify potentially relevant exhibits and allows the investigator to see the bigger picture and ultimately reveal key evidence and connections. Figure 1: Analyze suspect devices in ADF and export the most likely evidence sources into Nuix Investigator. Figure 2: Conduct collaborative investigations, dividing evidence between multiple investigators and subject matter experts. Figure 3: Cross-reference people and intelligence items across all relevant evidence sources Use ADF s triage software to analyze all suspect devices, identify the most likely evidence sources and conduct basic analysis, in either the field or in the lab. This will filter out devices that do not contain relevant evidence as well as cases that can be solved using ADF technology alone. This in turn dramatically increases the volume of data investigators can examine within a set timeframe (see Figure 1). Create an automated ADF analysis report, image the device and save the E01 file. Now load the images into Nuix Investigator, which can rapidly process and extract intelligence from volumes of data and multiple file formats. Once processing is complete, the investigator has instant access to the original ADF case report which includes matching keywords, files, MD5 hashes, regular expressions, videos, images, internet search histories, websites visited, USB device history and more. This allows the investigation to quickly continue without the need to recreate searches or find relevant evidence for a second time. Investigators can also leverage the ADF results to conduct in-depth analysis of other related devices that are part of the investigation, providing a seamless workflow. Use Nuix Investigator to perform the digital investigation and: Use powerful analytics to quickly answer the Who, What, When, Where questions from the evidence. Use Nuix Investigator Lab to reduce evidence into manageable data sets, allowing multiple investigators and subject matter experts to quickly gain access to the data and collaborate on understanding the evidence (Figure 2). Cross-reference intelligence with other data sources to pinpoint the most relevant information and evidence sources (Figure 3). Bookmark, report on and export the critical evidence unearthed during the investigation. PAGE 3

4 REAL -WORLD RESULTS This workflow ensures investigators can quickly get across large numbers of evidence sources, no matter what the file format. Because case investigators can quickly reduce data sets into manageable chunks, they can take a collaborative approach. For example they can pass on key evidence to digital forensics specialists or subject matter experts, who can then provide deep analysis for the courts. Below are examples of how ADF Solutions has helped quickly identify potentially relevant evidence and how Nuix has allowed investigators to see the big picture and find the smoking gun. CASE STUDY ADF Solutions Provides Quick Access to Closed Devices for Forensic Examinations CHALLENGE The Miami-Dade Police Department s Digital Forensic Section averages over 400 cases a year, with anywhere from one to dozens of digital devices per case. The lab examines more than 2,000 media items a year, and this number is growing exponentially. Not only was this sheer volume causing increasing backlogs, but many digital devices involved in the investigations featured closed architecture, and new miniaturized drive configurations made it difficult to remove the drives for traditional forensic examination. This was making traditional methods of data acquisition from these devices cumbersome, if not impossible. Additionally, there was a significant risk of damaging the devices when attempting to remove the drives. Detailing the registry contents into a report was also time consuming for the forensic teams using traditional forensic software, with key data having to be manually determined for the reports. SOLUTION Using ADF Solutions Triage-Examiner, specifically designed to access computers running Windows, Mac OS X and Linux, the lab was able to extract the data from 90% of all the computers containing difficult-to-access drives without having to remove the hard drive or risk damaging the device. The automated reporting process in Triage-Examiner listed all of the required information in an HTML or Microsoft Word report template that was easily shared with investigators involved with the case. This saved them a lot of valuable time and resources. RESULTS By eliminating the need to remove the drive from the device and applying a forensically sound automated triage solution, the lab dramatically saved time and resources: Increased the number of successful data acquisitions from hard-to-open devices to 90%. Reduced the decision time to send the device for a full forensic examination. Quickly shared the triage results with case investigators through automated reporting. Eliminated the risk of device damage and the associated liabilities. PAGE 4

5 CASE STUDY CHALLENGE Nuix empowers Guernsey law enforcement crackdown on financial crimes The Guernsey Border Agency and Guernsey Police work together on the front line of law enforcement in the Bailiwick of Guernsey a key transit point for global financial transactions. With the volume of data involved in such crimes increasing exponentially, traditional enforcement methods were struggling to keep up. Existing tools for searching digital evidence were designed to operate on individual computers. They offered little help consolidating and analyzing information that, in financial crimes, is often spread across dozens or hundreds of computers from all over the world. SOLUTION As the volume of data involved in fraud cases became too complex for conventional tools, Guernsey Police and the Guernsey Border Agency turned to Nuix Investigator Lab to keep up. Choosing Nuix meant the law enforcement agencies could: Combine multiple evidence sources for correlation, analysis and collaborative investigation. Identify hidden relationships across data sets with intelligence extraction capabilities. Enable investigators and external subject matter experts to analyze, review and collaborate on digital evidence. Receive strong support from Nuix to expand their forensic capabilities in response to the changing needs of live investigations. With the volume of data involved in financial crimes increasing exponentially, traditional methods were struggling to keep up RESULTS The Guernsey Border Agency and Guernsey Police are now equipped with the tools to successfully collect, organize and investigate a broad range of digital data that would otherwise have been too unwieldy for non-technical staff to manage, in-turn helping the authorities maintain the integrity of Guernsey s financial services industry. This has meant: A consolidated view of all types and sources of evidence, helping to paint an accurate timeline of the lifecycle of digital documents. Easier collaboration with external partners; the Computer Crimes Unit has been able to bring investigators and external subject matter experts such as lawyers closer to the evidence. This means the people with the greatest expertise and case knowledge can organize, analyze and identify anomalies in the available data. Helped both agencies comply with requests from overseas authorities under mutual legal assistance treaties. These treaties are often called upon in financial investigations, which frequently span multiple countries and legal jurisdictions. PAGE 5

6 ABOUT THE AUTHORS HARRY PARSONAGE Forensic Triage Specialist ADF Solutions Before joining ADF Solutions Harry Parsonage worked for nearly 31 years as a police officer in the UK, including 23 years as a detective sergeant. For the last 11 years of his service he managed a police digital forensic unit and was a hands-on forensic practitioner. In 2007 he introduced a triage process that reduced his unit s backlog from 12 months to less than six months over a period of just nine months. Harry is well known in the forensic community for his papers on MSN artifacts, Windows link files, and web browser session restore forensics. He is on the editorial panel for the UK Association of Chief Police Officers Good Practice Guide for Digital Evidence and Guide for Managers of ecrime Units. PAUL SLATER Director of Forensic Solutions EMEA Nuix Paul Slater has close to 20 years experience in investigations, digital forensics and ediscovery as a police officer and consultant. Slater started his career in forensic technology as a Computer Forensic Investigator in the Greater Manchester Police. He served as interim head of the Digital Forensics Unit in the United Kingdom Serious Fraud Office and implemented workflows that enabled the organization to process 20 times more electronic evidence each year. Paul was also a member of the review board for the 2012 update of the UK Association of Chief Police Officers Good Practice Guide for Digital Evidence. ABOUT ADF SOLUTIONS Advanced Digital Forensic Solutions, Inc. (ADF Solutions) is the market leader in media exploitation and digital forensic triage tools used for scanning computers and peripheral devices. Leveraging an intelligence-led approach, these easy-to-use tools rapidly extract actionable intelligence to help identify and capture suspects who are a threat to public safety or national security, and accelerate prosecution of criminals. These proven tools are actively used by field operatives in defense, intelligence, law enforcement, border security, and other government agencies worldwide. adfsolutions.com ABOUT NUIX Nuix enables people to make fact-based decisions from unstructured data. The patented Nuix Engine makes small work of large and complex human-generated data sets. Organizations around the world turn to Nuix software when they need fast, accurate answers for digital investigation, cybersecurity, ediscovery, information governance, migration, privacy and more. nuix.com Copyright 2014 Nuix. All rights reserved.