Home
Contact Us
[Posted on Thur, March 10 2005]
Dusting for digital fingerprintsForensic computing: As criminals and crime-fighters go digital, analysing clues from computers is a growing field
Source: The Economist
March 10, 2005
EVERY new technology leads to new forms of crime. As a Chicago policeman once put it: “No other section of the population avail themselves more readily and speedily of the latest triumphs of science than the criminal class.” He was speaking in 1888, about the electric telegraph. But he could just have easily been speaking about computers and networks today. As criminals adopt new technologies, crime-fighters must follow suit, devising new ways to gather and analyse evidence. In the case of modern digital technology, the result is the growing field of “forensic computing”.
The scope for using technology in criminal ways, and the complexities of catching people who do so, are illustrated by the case of a 42-year-old Maryland man who pleaded guilty last October to attempted extortion after sending threats and demands by e-mail, and was sentenced to 63 months in prison. For more than two years the man had sent sexually explicit e-mails to the clients of a patent firm using a forged e-mail address which made it appear as though the messages came from the company's own executives. Analysis of the company's computers ruled out the possibility of a malicious insider. Instead, further analysis of the e-mails revealed that they actually originated from multiple homes in a suburban area just outside of Washington, DC. The real culprit successfully created this confusion by driving around with a laptop and an antenna that could detect unsecured Wi-Fi wireless networks. Having found a network, he could then use it to send untraceable e-mails from his car.
The investigators used clinical psychologists to create a profile of the person behind the extortion attempts, and found that the home owners from whose networks the messages had originated did not match the profile. The man was also sending messages from several local university computer laboratories, using false or stolen accounts. The investigators responded to one of his messages, embedding tiny invisible graphics called “web bugs” in their replies in an attempt to determine the network address of the recipient's machine. But he spotted their ruse.
Finally, he issued a $17m extortion demand in an e-mail that contained personal details consistent with a primary suspect who had, by this time, been identified by the psychologists. The suspect was followed as he drove to one of the university computer laboratories from which incriminating e-mails had been sent. He was then arrested, and a search of his house produced evidence of his campaign against the patent firm, along with hand-grenade components and ingredients for the deadly toxin ricin.
This kind of computer-based investigative work, which involves tracing the digital footprints left by criminals on machines and networks, is becoming ever more important. In 1999, America's Federal Bureau of Investigation helped to launch the first Regional Computer Forensics Laboratory (RCFL) to support federal, state and local law-enforcement agencies. There are now six such labs across the country, and seven more will open by the end of this year. Last year the labs processed 107.9 terabytes of data, roughly equivalent to more than 4.5m boxes of paper filled with text. Douglas Schmidtknecht of the RCFL National Programme Office says the amount of data being analysed is growing exponentially.
While the public perception of computer crime is that it is carried out by malicious hackers and “script kiddies”, the greatest threat is often from within. “There's a huge rise in the number of cases of intellectual-property theft,” says Gordon Stevenson, managing director of Vogon International, a forensic-computing and data-recovery firm based in Bicester in England. Most of Vogon's forensic work involves conducting investigations for corporations that suspect employees of wrongdoing—and half of these cases concern intellectual-property theft. Mr Stevenson points out that employees can easily make copies of crucial data, from corporate databases to product blueprints. “They can e-mail it to themselves at home,” he says.
Tools of the trade
Forensic computing, like traditional forensic science, relies on a range of tools and techniques. Special software is used to gather evidence from storage devices and to apply cryptographic tags to verify that it has not been tampered with during the investigation. There are specialist search tools, e-mail scanning tools and disk-analysis tools; tools to gather information over a corporate network when investigating internal incidents; tools that monitor network traffic for suspicious behaviour; administrative tools to keep track of evidence from multiple cases, to plot events on timelines for analysis, and to generate reports. The leading vendor of forensic-computing tools is Guidance Software of Pasadena, California. Its EnCase software, which bundles together these sorts of features in various combinations, has 14,000 government and corporate users worldwide and is used by over 90% of America's law-enforcement agencies.
The first step in most investigations is to make a copy of the original evidence, typically by removing the hard disk from a computer and making a perfect copy of its contents without altering the original. To do this, the source disk is copied to a target disk using a tool known as a “write blocker” which only permits a one-way flow of information. The resulting stream of data can then be reconstructed into its original files (which are usually sprinkled in chunks across the disk) by consulting the disk's directory, a table that lists the locations of the constituent chunks of each file. Further analysis can reveal leftover chunks from deleted files, or previous versions of documents.
Similar tools are available to consumers to recover data from corrupted disks or “undelete” lost files. But forensic investigators can go one step further, using “spin stand testers”—devices normally used by disk-drive manufacturers to test their products. These rely on the fact that modern disks generally store information in narrow, concentric circles on each disk, along a track about 400 nanometres (billionths of a metre) wide. Since the track is so narrow, new data do not always get written directly on top of old, slivers of which remain at the track's edges. By picking up this information, it is sometimes possible to reconstruct files that have been deleted or deliberately overwritten.
Network traffic can also be used as the basis of an investigation. Recording all the data flowing across a network is impractical, but it is possible to monitor patterns of traffic, types of traffic, attempts to access particular machines or parts of a network, and so on. So-called “intrusion-detection systems” do just that, sounding an alarm when something suspicious happens. The logs generated by such systems can therefore reveal telling details about network activity. Other network tools examine the contents of data packets zipping across the network, and record selected streams of data for subsequent playback and analysis. Such systems can capture e-mails to or from specified people, reconstruct instant-messaging conversations and even record and replay voice-over-internet phone calls.
As well as gathering evidence from hard disks and network traffic, investigators must also stay abreast of the rapid evolution of portable devices. Data can be copied on to a music player or keychain flash drive, or hidden on the memory card of a digital camera. These devices provide new sources of evidence, but also create new challenges for investigators, says Eoghan Casey of Stroz Friedberg LLC, a computer-security and forensic consultancy that took part in the investigation that followed the collapse of Enron, an energy company, in 2001. “The fact that many handhelds are connected to networks increases the amount of data they generate,” says Mr Casey, who also edits Digital Investigation, a quarterly journal.
Making the case
When presenting digital evidence in court, investigators must be able to demonstrate its integrity and provenance. “You don't just walk into the court and say 'Here's a hard drive',” says Mark Pollitt, the former head of the FBI's RCFL network who is now an independent security consultant. As with physical evidence, which must be stored and handled appropriately, this can involve procedures (such as timestamping) to ensure that digital evidence has not been tampered with or mixed up. The need to take these extra steps has not discouraged people from introducing digital evidence. Mr Pollitt notes that five years ago, a motion for electronic discovery in a civil lawsuit was the exception rather than the rule. Now, he says, virtually every lawsuit involves this type of request.
A decade ago, companies offering forensic-computing and data-recovery services dealt mostly with government requests. But these days they are often called on directly by businesses and lawyers investigating intellectual-property theft or inappropriate use of corporate systems by insiders. A common complaint from specialist investigators in such cases, however, is that investigations by incompetent staff can contaminate the evidence. “What they don't realise is that they've muddied the water,” laments Nouman Mir, a forensic-computing specialist at Data Recovery UK, a British firm.
That companies are unaware how to handle digital evidence is not surprising, since such cases are generally hushed up. That, in turn, causes the scale of the problem to be underestimated. But there are ways around this. Britain's National High-Tech Crime Unit (NHTCU) lets companies provide details about security breaches in confidence. This contributed to a five-fold increase in the number of firms participating in the NHTCU survey last year, compared with 2003. Better data, ever more elaborate tools and greater awareness will be needed if the crime-fighters are to keep up with the criminals.
[Original Article on the Economist site ]