Special Report | NIST's goal: Keep digital evidence fresh

Lab offers tool-testing kit, builds reference library

DOD also puts tools to the test

The Defense Department's Cyber Crime Center evaluates hardware and software to determine whether the technology will meet DOD's forensics needs. DC3 publishes an online catalog available to federal agencies and law enforcement organizations.

DC3 either tests and evaluates the technology or studies it for its applicability to forensics work. The organization approved its first product in June 1999.

Since January 2006, DOD has evaluated nine products. DC3 has:

  • Tested the Dell 670 and the HP xw9300 workstations for potential as platforms for forensic examination

  • Examined the efficacy of the Navy RAID clearing methodology

  • Examined the deconstruction and extraction of e-mail messages from the .dbx and .mbx e-mail database files generated from Outlook Express Versions 4, 5 and 6 using MBXtract Version 2.11, DBXtract Version 3.70, and ILook Investigator

  • Tested the ability of the DC3 Forensic Boot CD to boot in a forensically sound manner

  • Examined SAMInside 2.3.0.1, which is used to remove the syskey encrpytion added by Microsoft Windows XP/2000 from the stored password hashes residing in the Security Account Manager registry file

  • Examined the efficacy of the Navy method for securely overwriting data from hard drives

  • Reported on the ILook IXImager and ILook IXImager version 1, a digital media investigation tool used within a Linux environment.

To see a complete list of the hardware and software DC3 has approved, go to GCN.com and enter 635 in the GCN.com/search box.

Ideally, a test lab will take [the NIST test kit] and test all the products out there.'

' Jim Lyle, NIST

Rick Steele

Scientists at the National Institute of Standards and Technology are known for sweating the nitty-gritty details of dull but vital standards for everything from bulletproof vests to medical measurement devices and IT encryption.

And now, agency experts are bringing the same precision to computer forensics, fully aware that the final say lies in the notoriously low-tech realm of the judicial system.

NIST's efforts are two-pronged: a library of software applications and programs for testing the reliability of forensics tools.

Since 2001, it has maintained the National Software Reference Library, with support from the Justice Department's National Institute of Justice and law-enforcement agencies. NSRL is an actual library of CDs for 7,120 software applications.

'We've got one of everything we could get our hands on,' said Douglas White, a computer scientist in NIST's Information Technology Laboratory.

NIST runs algorithms against the disks to generate digital 'fingerprints,' or hashes, of files, for which it then creates a metadata index. The two together form the Computer Forensic Reference Data Set (RDS) for digital evidence. In a trial, if a court questions the RDS, NIST can prove its authenticity by regenerating the hashes.

Evidence locker

CDs usually aren't loaned out. Keeping the originals 'is very important for evidentiary purposes,' said John Tebbutt, another NSRL computer scientist. 'We do not lend it out because we have to keep it under evidence locker conditions.'

As of March, NIST reported, the RDS contained nearly 11 million hashes for three times as many files, and the Web site, www.nsrl.nist.gov, gets nearly a quarter-million hits a month.

Law enforcement agencies and other computer forensics specialists pay $90 a year for quarterly updates.

The RDS speeds investigations by identifying files that can be ignored'say, a Microsoft Office executable file. It also can highlight hidden and altered files.

NIST staff members say NSRL is such a normal part of the daily work of forensics labs that they don't typically hear success stories from subscribers. Ubiquity can be a better measure: White said the FBI sends copies to all its field offices.

While the basic concept behind it hasn't changed, NSRL is advancing in other ways. NIST is developing a process for hashing network files to address the increasing volume of evidence stored on servers, which are difficult to take into physical custody.

'You have to do what's called a live acquisition'acquiring the forensic information from a machine that's actually running,' Tebbutt said.

NIST also is working on hashes that operate on storage blocks, a potentially faster, more precise method than the black-and-white file hashes, which can be thrown off by minor file changes. White said block hashes will make it easier to exclude unimportant files. NIST has provided hashes to several states that hope to prevent software tampering in voting machines.

Testing methodologies

NIST's other effort is the Computer Forensics Tool Testing project, designed to ensure the capability of forensics testing tools.

Lacking an industry standard, NIST had to improvise. 'We started ... writing requirements for what we thought the different forensic functions should be,' said NIST computer scientist Jim Lyle. 'We needed to come up with a list of acceptable tool behaviors and ... unacceptable tool behaviors.'

Lyle said CFTT is limited in the testing it can do itself. The real value is in the test kit and test specifications it offers to other labs.

'Ideally, a test lab will take that and test all the products out there,' Lyle said.
Each product handles one of four main functions, though some, including the widely used EnCase from Guidance Software Inc. of Pasadena, Calif., have expanded beyond their original purpose.

The first step is imaging: making a copy of a seized disk to use without touching the original. Forensics-grade tools go beyond run-of-the-mill utilities by adding hashing, checksums and other authentication technology that holds up in court.

Next comes hard-drive write protection to prevent tampering; it is also available as a hardware device. The other two functions are deleted-file recovery and string-searching tools, which help find evidence on the disk. NIST has specifications and results for the first two and is developing them for the others, Lyle said.

Unlike most computer technologies, forensics tools aren't driven much by industry or vendor standards, according to Tim Leehealey, vice president of business and corporate development at Guidance Software.

'What makes a tool or a process forensically sound is less about standards bodies and more about what courts will accept,' Leehealey said.

But Lyle seems less sanguine, saying the full implications of the Supreme Court rulings, called the Daubert standard, on the admissibility of scientific expert testimony, are not yet clear. Under Daubert, federal judges now are required to control all scientific evidence, including technology. Judges are expected to analyze expert witnesses to ensure their statements are both 'relevant' and 'reliable.'

The need for comprehensive standards only will increase if demand spreads to other areas such as the security of classified documents and detection of hackers, a trend Leehealey already sees from federal customers.

'People have realized there are literally hundreds of reasons to conduct investigations,' he said.

David Essex is a freelance technology writer based in Antrim, N.H.

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above