At the scene: Analyze devices faster and get results

Sometimes red flags pop up pointing to a need for change, and that’s exactly what happened in the Pasco County, Fla., Sheriff’s Office a few years ago. Narcotics and vice officers executed a knock-and-talk at a home, and when the suspect wouldn’t...


  • Write blockers. The UltraKit III from Digital Intelligence, for example, houses a complete set of write blockers that allow investigators to capture a forensically sound image of a hard drive or storage device. The hard drive duplicator, Data Copy King (DCK) from SalvationDATA, also can be used for this purpose.
  • Specialized digital forensics software, such as Guidance Software’s EnCase Forensic or AccessData’s Forensic Toolkit (FTK).
  • Software designed to analyze phones and other portable devices. Susteen’s SecureView for Forensics, Micro Systemation’s XRY, Paraben Corporation’s P2 Commander, and Cellebrite’s UFED Ultimate all perform forensic analysis of today’s cell phones, including smart phones.
  • A powerful forensics computer. Forensic Computers Inc., HTCI and Digital Intelligence will custom-build computers to meet a department’s digital analysis needs. “This is not a computer that can be purchased at Best Buy,” Fazio explains. “It won’t have the power to run digital forensics software.”
  • A forensics laptop, such as a rugged laptop from Dell, to perform digital forensic analysis in the field.
  • A dedicated server to store digital evidence.

But with a $50,000+ price tag to get started and $30,000+ in annual upkeep after that, a full-blown lab may be more than the average mid-size department can afford. The good news is they can enter the digital forensics space on a smaller scale, says Eskridge. “Smaller departments can add a triage-level forensic capability that works for 70 to 80 percent of their cases,” he says. “This type of lab can be set up for about $10,000, including a cell phone solution.”

This capability would allow smaller departments to perform first-level triage, or scan devices for investigative information. In a child pornography case, detectives might employ technology such as Paraben’s P2 Commander or Dell’s Mobile Digital Forensics software to collect pictures off the computer.

Cell phones can be quickly processed with tools that rely on advanced plug-in technology to quickly search through emails, chat logs, messages, Internet files and call data. “Cell phone forensics tools fit well with the whole triage concept,” says Eskridge. “With a $2,500 tool and five minutes, they can retrieve the same information they’re going to get from a lab in three months.”

Meanwhile computers may be searched with triage tools from Guidance Software and AccessData, which have a lower price point than their more advanced software. AccessData’s AD Triage allows officers to safely view and collect data from computers at the scene, while EnCase Portable is delivered on a USB device that allows officers to quickly and easily collect digital evidence in a forensically sound manner.

Dell’s Mobile Digital Forensics solution utilizes Dell rugged laptops running SPEKTOR software from Evidence Talks to collect forensic intelligence in the field. This system also identifies and pulls data from desktop computers, laptops and portable devices. But its primary advantage is that it puts all the digital forensics tools into one “suitcase.”

“The problem with triage is that some triage devices are very specialized. Some only do phones, some lend themselves to laptops and computers, others only do GPS or satellite devices,” says Sundarababu. “The second problem with many devices is that the analysis still must be performed by a very experienced person. Dell combines all of these capabilities into a single system, and you don’t have to be a forensic expert to do the work.

“An investigator simply asks the system to look for specific types of evidence, such as emails, images, etc., and then the tool automatically scans the device for this data,” he continues. “And before, if they had 3 terabytes of data, it would take them weeks to process. This scan takes just minutes.”

Training

Digital triage tools are meaningless however without training, says Pepenella.

Officers running digital forensics exams need a basic understanding of digital devices and the information they may house. They also require an understanding of how digital technologies store data, the file formats they use, and the operating systems they employ.

Pepenella recommends departments tap into the free classes offered by NW3C to develop a foundation for computer forensics exams. They can then obtain advanced training from places such as the Federal Law Enforcement Training Center (FLETC), the Department of Defense Cyber Crime Center (DC3), and SEARCH.

But before investing a dime in technology or training, Pepenella advises agencies to do their homework. “Reach out to someone in law enforcement who has done this for awhile,” he says. “Ask them how they store their data, how they conduct their investigations, and for their recommendations on how to streamline the process and make it better.”

And, above all, Pepenella advises departments to take action now. “Don’t wait for a red flag to pop up in your jurisdiction before you realize the need for this capability,” he says. “Law enforcement needs to embrace the digital investigation, or they are going to be left behind, while the criminals move ahead.”