Electronic Crime Research Priorities
NIJ discovers what the field needs through its Electronic Crime Technology Working Group to help define and direct NIJ's electronic crime research agenda.
Current needs identified by the working groups include:
1. Data-carving tools. NIJ seeks the development of data-carving tools and technologies that can perform more rapidly and effectively than currently available tools. Data carving is the process of extracting specific data subsets that correspond to specific files from larger data sets. This function is frequently employed during analysis of unallocated space on a digital media device—that is, areas on devices that are not currently assigned to a file but may still hold data from files that were deleted. Applicants are encouraged to consider sector hashing and carving techniques, particularly for recovery of full or partial multimedia files.
2. Peer-to-peer investigative tools. NIJ seeks the development of tools to investigate the use of peer-to-peer technologies to facilitate criminal activity such as the distribution or sharing of contraband material. Such tools will be specifically designed to address decentralized peer-to-peer network protocols (e.g., KaZaA), or unstructured peer-to-peer network protocols, such as Gnutella. State and local law enforcement is particularly interested in solutions that result in tools that will identify users who are sharing known contraband on a particular network based on a known hash value.
3. Tools for small-scale devices. NIJ is interested in tools for small-scale devices (e.g., BlackBerrys®, Palm® devices, cell phones, and personal digital assistants). State and local law enforcement need tools for small-scale devices that can recover system files, operating system information, applications, deleted files, and unallocated space. Proposals should also address the development of tools that can perform the following:
- Better identify data formats on small-scale devices.
- Create image files of data on small form factor devices.
- Recover digital media files on small-scale devices.
- Facilitate the forensic analysis of digital media on small-scale devices.
4. Increased data storage capability. NIJ is interested in the development of innovative tools and technologies to address the need for increased data storage capacity to archive large-volume data sets generated in computer forensic examinations. Proposals that involve purchasing more (and larger) media for storage will not be considered an innovative solution. Proposals should address such solutions as greater compression algorithms or other methods as a means of addressing the legal requirements for data storage.
5. Imaging tools for networks and network-attached devices. NIJ is interested in the development of imaging tools for networks, as well as network attached or connected devices. In the development of these solutions, applicants should address one or more of the following issues:
- Redundant Array of Independent Disks (RAID): A RAID is a disk subsystem that is used to increase performance and/or provide fault tolerance. A RAID uses a set of two or more ordinary hard disks and a specialized disk controller that contains the RAID functionality.
- Wireless network devices including: routers, gateways, network interface cards (NICs), repeaters, switches, hubs, and wirelessly connected external digital media.
- Network data storage devices connected via computer to the network, as well as data storage devices connected directly to the network via a wired or wireless network interface or connection.