Investigators now crack crime computers on the spot
(Credit:
VOOM)
A new system allows investigators to boot, run, and install investigative tools to examine computers used in the commission of crimes or terrorism, without altering the contents or compromising the chain of evidence, according to the inventor.
It's common today for computers and their contents to be tagged as evidence. The problem has been how to boot and examine their contents, and still maintain "forensic soundness." Traditionally, this required painstaking hours of copying and transferring data. The result was a huge backlog in computer crime labs across the nation, while investigators waited months for forensic information to be processed, according to Voom Technologies Inc.(PDF)
The VOOM Shadow 2 is a hardware device designed break that logjam by providing "read write access from the host computer's perspective." It also includes a built-in hardware write blocker to maintain the original hard drive unchanged, according to VOOM.
"What a competent (computer forensics) examiner can do in a day with the Shadow, would surely take weeks or months using alternative forensic procedures," said investigator and former U.S. Customs Special Agent Will Docken in a testimonial.
The system allows seeing and operating the "native system," whether it's Mac, Linux, UNIX or Microsoft, according to the company. No more waiting for processing or forensic lab examination- you can start rummaging before the corpse has cooled.
Mark Rutherford is a West Coast-based freelance writer. He is a member of the CNET Blog Network, and is not an employee of CNET. Email him at markr@milapp.com. Disclosure. 
Uh-oh, operating the native system? Including Mac? Wouldn't that be running Mac software on non-Apple hardware (Voom Shadow)? So will they get sued too?
Any security professional that knows what he's doing doesn't need a name brand to do his job.
1) Time. What if your child was abducted? Do you want to wait hours for a copy, followed by a lab examination of the computer (could be the abducter's or your child's computer)? Or would you rather have a trained computer forensic investigator be allowed to immediately access the computer, and operate it just as the suspect/victim did, without comprimising the evidence?
2) Forensic Investigation - a traditional forensic investigation requires the duplication (copy) of the drive followed by a lab examination with very good tools such as Encase or FTK. However, this is again time consuming, and the investigator still does not have the ability to operate the suspect computer as the suspect (or victim) sees it. The Shadow provides an adjunct and very fast analysis not previously available.
3) Forensic Investigation - software virtualization can attempt to operate the suspect computer - virtually. Still requires the copy process, then loading into the virtual environment. Sometimes it just does not work. Other times, it takes substantial time to tweak the software so that it works, Other times, it "sort of": works.
4) Make a copy? Run the disk on another computer (typical process). Now the eveidence is changed. You can get the information, but how do you get back to the pristine state? Answer - another copy. How much time do you have?
5) Court presentation. How much more powerful would it be to you to see the actual suspect computer operating in a court room, rather than explanations of chain of evidence, and explanations of printed computer lab reports. Time, confusion, opportunity for the defense to obfuscate, etc.
6) Confessions: THrough the use of the Shadow, investigators report much quicker plea agreements, as suspects are faced with their own computers run in real time - no opportunity for obfuscation, defense tactics, etc. Less court time, less trials, more convictions - saves time and tax payers dollars and frees up detectives, DA's, judges, court systems, and computer forensics labs for the cases that require the type of in depth analysis required to locate fragments of documents/pictures and other data in deleted files, slack space and hidden partitions, and/or to deal with cracking passwords
There are many other reasons. The best reason is real-life detectives and district attorneys who use the Shadow swear by it.
Law enforcement will stop using it. Voom will go out of business...
Caveat: Having ranted, I should note that the description above makes the video sound completely innocent and that may be misleading. It was still nice to vent.
- by Harrison912 December 12, 2008 9:36 AM PST
- Thanks, Mark, for this article. As a web site owner for safety and security products, I always like to hear about new technology to help catch the bad guys.
- Like this Reply to this comment
-
(16 Comments)