Australian university students have developed a Linux-based data forensics tool to help police churn through a growing backlog of computer-related criminal investigations.
The tool was developed by students from Edith Cowan University's School of Computing and Information Sciences and will help the Western Australian Police Computer Crime Squad process their forensic investigations.
Called Simple (for Simple Image Preview Live Environment), the software allows investigators to view and acquire forensic data at the scene of the crime without compromising the integrity of data as it is collected.
"It's a Linux Live CD that we have built from the ground up. We customized the kernel and the underlying operating system so that when it runs it's incapable of writing to the hard disk or any other storage," Peter Hannay, the software developer behind the forensic acquisition tool told ZDNet Australia.
"We stripped out a large amount of functionality because we want to maintain the integrity of data collected, so we removed all network support and the ability to write to disk. Also, if for some reason a disk is writeable, the system will halt automatically," he added.
The Simple tool searches the system for specific file types like MPEG or JPEG files, saving time on the often lengthy search process.
Hoping to achieve even greater automation during the collection of evidence, Simple will soon be equipped with skin-tone analysis capabilities to help detect relevant files.
The idea for the tool first came when the Western Australian Police approached the university in 2006, since its investigators could not handle the amount of computer forensic data requests, which relate mostly to child pornography and bestiality.
Normally police need to take the PCs back to the station to begin acquiring forensic data, but with this tool, according to Hannay, police will be able to collect the data on the spot.
Liam Tung of
ZDNet Australia reported from Sydney.
This type of disk has existed for years. The International Association of Computer Investigative Specialists has SPADA, Forward Discovery has RAPTOR, and there is Helix just to name a few. We can always use more tools but this is nothing new.
An obvious flaw in this system - which boasts of keeping the integrity of the evidence - is that they are saving everything as a JPG file, the worst possible kind of file because it compresses every time the file is saved, throwing out more and more information to reduce file size. This is pretty basic stuff to be aware of.
@farmeunit - It's made to see if there is anything there in the way of movies (mpeg) or images (jpeg). There have been tools out for years like this. This is not news to anyone but people like yourself.
How about: http://www.linux-forensics.com/ Based on Knoppix as well and it's free.
Tommy Jordan, the man who shot his daughter's laptop for YouTube, gets a visit from police and child protection services. Oh, and Good Morning America.
The Samsung Galaxy Mini 2 S6500 could make its debut at the Mobile World Congress in Barcelona later this month, according to a leaked promotional image.
RIM isn't doing much to innovate its handset designs, so maybe it should call up designer John Anastasiadis, who has a pretty interesting concept for a BlackBerry.
Check out:
<a class="jive-link-external" href="http://www.spada-cd.info/about.htm" target="_newWindow">http://www.spada-cd.info/about.htm</a>
<a class="jive-link-external" href="http://www.e-fense.com/helix/" target="_newWindow">http://www.e-fense.com/helix/</a>
"Previewing", maybe. But not "collecting"
How about: http://www.linux-forensics.com/
Based on Knoppix as well and it's free.