Digital forensics moving from an art to a science
- By William Jackson
- Jul 29, 2005
LAS VEGAS'The Defense Cyber Crime Center is seeing a growing demand for its forensics services, and a growing demand for professionalism on the part of its investigators.
"Digital evidence is now an established forensics profession," said Jim Christy, director of the center's Cyber Crime Institute. "We are going from winging it to being certified practitioners."
The center's forensics lab now is undergoing a third-party certification process, Christy said yesterday at the Black Hat Briefings security conference.
"When we're done, we'll be an accredited digital forensics lab, and probably the world's best," he added.
Forensics is the application of science to the legal process. Although digital forensics involves data analysis, it is distinguished by the need to comply with legal requirements in legal proceedings.
More states are beginning to require lab accreditation before digital evidence can be admitted into evidence, according to Christy.
Although business is booming, investigators spend relatively little of their time fighting hackers. "The number one cybercrime for all jurisdictions is child pornography, not intrusions," Christy said. The center also finds itself involved in murder investigations, espionage and the war on terror.
Christy said investigators were worried that the spread of stronger encryption in the early 1990s would hamper their work, but that has not happened.
"Fortunately, criminals are just lazy and stupid," he said. "What is killing us is not technology, but the sheer volume."
The average case the lab works on now involves 119G of data and 68 pieces of media, which can range from PC hard drives to personal digital assistants and Global Positioning System devices.
The lab's workload peaked in 2003, when it received 147 terabytes of data ' more than half of it from a single espionage case.
"It took 17 or 18 months to go through all of that data," Christy said. Much of the remaining data was from the wars in Afghanistan and Iraq.
Aside from the sheer volume, another challenge is working with obsolete equipment while adapting to new technology.
Two years ago the lab handled a case involving data from an old TR80 personal computer, nicknamed a 'Trash 80' by techies. "And we had a Trash 80 and the software for it," Christy said.
At the other end of the spectrum, Global Positioning System devices have gone from being a luxury to an appliance, and more are turning up in investigations. "Lots of great information coming out of GPS devices," Christy said. "It will tell you everywhere that thing has been."
The move toward professionalism in digital forensics is a positive development, but it is putting a strain on the resources of state and local law enforcement. "It is expensive, but there's no going back," Christy said.
William Jackson is a Maryland-based freelance writer.