Digital-evidence

Forensic examiners, forensic analysts, and law enforcement officers face a critical challenge in processing and analyzing large amounts of digital evidence. With traditional methods, the time-consuming and complex process of evidence analysis can lead to errors, and the risk of evidence contamination is high.

Forensic backlogs are an increasing concern for many law enforcement agencies. Forensic backlogs are an increasing concern for many law enforcement agencies. Agencies must shift from simply collecting digital evidence to effectively analyzing the digital evidence collected. Media analysis is time-intensive and requires training to ensure that all pieces of evidentiary value are identified and processed.

In order for your digital evidence to be used in a court of law you should take care in your evidence collection procedures from digital devices. Best practices for collection are designed to help you maintain the integrity of evidence. Individual agencies may have their own policies and procedures in place but overall general practices may be similar.

The United Kingdom is facing a severe absence of forensic processing capacity, leading to a backlog of forensic work requested by law enforcement agencies across the country. Long delays in receiving results can have major implications for the criminal justice system and can leave vital evidence untested, resulting in convictions potentially being overturned or offenders going free. This blog article will discuss the issue of forensic backlogs in the U.K. and the steps that are being taken to reduce them, to the benefit of law enforcement agencies.

Digital forensics is an important tool in the fight against crime in the current digital age. It is also a rapidly evolving field, with new technologies and techniques being developed all the time. In this blog post, we will take a look at the state of digital forensics, and how it is being used to combat crime and solve digital investigations.

The preservation of digital evidence begins at the crime scene. It is imperative for all parties involved including forensic investigators to take active measures in the preservation and collection of digital evidence. Not only are computer data and digital evidence fragile, but forensic investigators must also consider laws when seizing and accessing electronic devices and the evidence stored in them.

At one time or another, law enforcement agencies find themselves investigating child sexual abuse material. Now more than ever there are a variety of ways in which this material is distributed amongst persons and online. It has become a priority to provide investigators with the tools necessary to identify and report on these materials. 

As technology continues to change, police departments must look for ways to increase efficiency and management, and one area that requires continuous innovation is police evidence management.

Compassionate policing involves law enforcement engaging with their community through the process of building collaborative relationships, mutual trust and respect, common interests, and a sense of shared responsibility [1]. Continuous exposure to confrontation and work stressors may result in an officer's inability to cope with the pressures, and therefore a loss of compassion when dealing with the public. This can lead to strained relationships with the citizens of the community. Compassionate policing goes beyond just the officers and extends to organizations as a whole. Its ideas and practices may also be applied to digital forensics and incident response.  

In a technology-dependent society, many of our daily tasks involve an electronic device. Our activity on these devices is stored and can be traced back to its source with the use of computer forensic software. A multitude of crimes are committed in which suspects unknowingly have some trace of evidence left on their electronic devices. This makes digital evidence collection possible. Evidence can come in a variety of forms such as photos, searched items, audio-video files, web history, and more. Even files that have been deleted can often be retrieved again by investigators with the use of computer forensic software. 

Computer forensic software is a key tool used by forensic investigators during digital evidence collection. This software aims to allow forensic investigators to identify, collect, and analyze data quickly and efficiently. There are two types of computer forensics: network forensics and host-based forensics. Network forensics focuses on the investigation of network traffic and session information. Host-based forensics collects and analyzes individual computer systems [1]. Computer forensic software should provide range and flexibility in its use so that a variety of law enforcement entities and corporate companies can apply it in investigations. ADF’s computer forensic software accomplishes this task, among many others.

Digital forensic investigations can be expensive. The price can range from $2000 to well over $100,000 for forensic tools and training [1].

The most common reasons why digital forensics tends to get expensive are: 

• inexperienced/untrained users
• outdated systems
• challenges with acquiring systems
• systems that don't talk to one another
• timing in the collection or reviewing of evidence
• reporting

The Global Forensic and Justice Center hosted a panel on The Value of Digital Evidence in Combatting Child Exploitation and Human Trafficking. The panelists included:

• Alexandria Wong, Digital Media (DOMEX) Trainer with the Global Forensic and Justice Center and FIU
• Sondra Skelaney, Gender Violence Prevention Program Coordinator with CASE and FIU
• Ailsa Slack, Director of Customer Success of ADF Solutions.

The panel focused on the role of technology, forensics, and digital evidence and revolved around four central questions which are highlighted below along with the key points discussed by the panel of subject matter experts.

When investigating computer crimes and being called on to conduct computer forensics or forensic phone analysis in the field, it is good to be ready for whatever comes your way. One phrase you commonly hear when talking to anyone in the cybercrime arena is “there has to be more than one tool in the toolbox”, and this is a very true statement, no one tool does it all, and all tools do it slightly differently. You do not use a large Phillips screwdriver to remove a small screw from a picture frame and you do not use an eyeglass screwdriver to remove a wood screw, this is because you know your tools and your toolbox.

Digital forensics is the science of recovering files, artifacts, and evidence from digital devices including mobile phones, tablets, computers (including Windows, Mac, and Linux), external drives, drive images, and other media storage (USB flash drives, memory cards, etc.). 

When starting an investigation we start thinking about what we need or who we need to contact when it comes to specific crime types. As investigators we do this second nature, it is a process that just happens, and if we have never investigated a certain crime it can be overwhelming at times. Specific crimes often need specialized training and have agencies that may need to be contacted for assistance. When it comes to the digital evidence we also start thinking of the steps that need to be taken and how we are going to put things together. Let’s not let this be overwhelming as well.

ADF tools have the ability to scan all available Mac computers (M1 and T2 chips) with all types of encryption and virtual drives by running a remote agent that communicates with the desktop application. 

With an ever-increasing number of adults owning a smartphone, it is no wonder that more and more crimes now commonly require mobile device evidence collection and analysis. The need for digital forensics tools is increasing around the world. The ultimate field forensics for the front line solution for police, sheriffs, school resource officers, field agents, and investigators. Connect a suspect device via a USB port to quickly collect evidence and perform an advanced logical acquisition (multi-protocol data transfer).

There are many ways to learn digital forensics. From Certified Training to short How-To videos designed to teach you skills in just a few minutes. One of our favorite forms of learning, however, is our one-hour digital forensic best practices webinars led by our Director of Training, Richard T. Frawley. Rich spent 22 years in law enforcement. Most of that time was as a digital forensic analyst. Here are some of our favorite learning webinars from this year:

Within ADF software and forensic triage products, including Digital Evidence Investigator, Triage-Investigator, or Triage-G2, an investigator can quickly find Dark Web traces. This can be done in Quick Profiles but in this video, Rich Frawley shows how to use an Intermediate Profile to triage a suspect machine to identify Dark Web traces. These can be found in ADF's Anti-Forensic Traces Capture. 

In this 3-minute "How To" video, you'll learn the benefits of having a digital forensic triage process that works from field to lab. Using ADF digital forensic tools, examiners can prepare field investigators to find digital evidence and intelligence on mobile phones, tablets, computers, and storage devices starting on-scene. 

The Encrypt backup feature in iTunes locks and encodes your information. In this short How To video, Director of Training, Rich Frawley shows investigators how to remove the known iTunes backup password, if required.

Investigators can now scan all available Mac computers (including macs with T2 or M1 chips) with all types of encryption and virtual drives by running a remote agent that communicates with the desktop application. Now you can perform digital forensic triage on all Macs including

• macOS T2 chip
• macOS M1 chip
• Mac Fusion Drive

Digital Forensic Triage is the process of finding digital evidence important for investigations.

When collecting digital evidence, speed is often the name of the game, such as when you are serving a search warrant, dealing with a mass casualty incident, working a consent search, or trying to ascertain where to focus your efforts when dealing with multiple devices. When dealing with these types of use cases, one-dimensional or one size fits all evidence collection, will not pass muster and you need the ability to cut through the noise and get to the relevant information fast. 

Getting ready to work off site, out of the lab, out of your office, and in someone else's domain is never an easy task. Whether it's a search warrant, in a client's office, suspect's residence, or some other off-site location, being prepared is the key to your success as a digital forensic investigator.

ADF Authorized Partner, First Digital & Techno-Law Forensics and the Computer Forensics Institute of Nigeria are hosting the International Digital, Mobile and Computer Forensics Conference & Training Expo as a virtual edition.

The conference, also known as DIGIFOR2020 will be held September 23-25, 2020 and will feature sessions including:

ADF prioritizes digital evidence collection and provides investigators and examiners post-scan options to speed investigations. Post scan options let digital forensic investigators get fast and relevant evidence to make decisions on-scene and in the forensic lab.

Learn how to easily remove CSAM images and other properties from view

One of the most important factors in a child exploitation investigation, is having the ability to show a report to a colleague, co-worker, prosecutor, or present to present your findings in court without re-victimizing the subject of the photo, or shocking the sense of the viewer of the report. Having a professional report that still reflects the properties that need to be presented is essential to your case.

Digital Forensic Investigators and Examiners need to be able to find evidence quickly and one of the ways that ADF provides this capability is using PhotDNA. 

As digital technology becomes more advanced, the potential for its criminal application is magnified. This can result in overwhelming amounts of digital data for law enforcement to inspect in a limited timeframe. Although opportunities to find digital evidence on a perpetrator's or victim's computer may be numerous, the time it takes to search through such vast quantities of data contributes to the issue of growing forensic backlogs. 

Learn how to use the ADF Quick Saved Credentials Profile to uncover Web credentials in this short video tutorial. Collecting saved credentials quickly gives investigators access to accounts that may have previously been unknown and allows investigators to request preservation orders and search warrants.  

ADF's Quick - Saved Credentials profile is a powerful digital forensic triage profile that extracts the usernames and passwords from Web Browsers. It is the only Search Profile that may trigger the anti-virus on the machine.

One year ago today, we launched Mobile Device Investigator^Ⓡ (MDI), ADF’s powerful mobile phone forensic software that allows anyone, from seasoned investigators to non-technical team members, to quickly conduct iOS and Android investigations in the field. Using MDI, investigators can acquire evidence fast and return devices to cooperating witnesses on-scene, and triage devices that need to be seized and brought back to the forensic lab. 

Today’s investigators and prosecutors are very familiar with the extreme difficulty in child exploitation cases: getting through your forensic backlog to get to the data in time. Law enforcement officers routinely report that a lack of technology which, combined with stringent time limits, can severely restrict their ability to check devices in a timely manner. ADF understands that digital forensic examinations can be both costly and time-consuming, which hampers investigations into suspects that have downloaded or participated in Child Sexual Abuse Material (CSAM). 

It's a known issue that many agencies and departments are facing worldwide; how to fight and reduce backlog to stay up to date on cases so that they don't get stale. It's a serious issue, but we at ADF can show you a few ways to fight in-house forensic backlog with digital forensic triage.

RAM, short for Random Access Memory, is physical hardware that temporarily stores data for quick read and write access. Think of RAM as a scratch pad you use while working; although all the information you need and may refer to is stored in a binder (in this analogy, your hard drive), the information on the scratch pad is what you are using and need right in the moment. With RAM, it is right there for you to access. While RAM helps with the speed and efficiency of the computer, it can all be lost in an instant as it is volatile.

The Child Abuse Image Database (CAID) is the United Kingdom’s national system used by law enforcement to help fight the growing problem of Child Sexual Abuse Material (CSAM). The system helps police detect, flag and analyse illegal digital media images. 

Child pornography- more properly identified as Child Sexual Abuse Material (CSAM). It’s appalling that there is a need for a definition for this kind of material. U.S. Federal Law defines child pornography as any visual depiction of sexually explicit conduct involving a minor- meaning any person less than 18 years old. 

Nearly 1,000 homicide investigators from across California gathered this week at the 51st annual California Homicide Investigator (CHIA) Conference in Las Vegas, Nevada. The 3-day training event, sponsored by ADF, featured case presentations and investigator training from leading prosecutors and investigators. 

ADF computer triage has long been admired for some of the best digital forensic triage capabilities on the market. Since 2006, ADF digital forensic experts have been building triage tools to empower investigators to quickly collect evidence and on-scene intelligence from computers and digital devices.

In this how-to video, we will cover backing up and scanning encrypted iOS devices. This skill is important to know because encrypted iOS backups return more data than unencrypted backups.

Looking to add key words on-scene? ADF has you covered. In this how-to video, investigators and analysts will learn how to add keywords directly from the Collection Key. As a digital evidence investigator, ADF provides the ability to create a collection key with or without Search Profiles and add keywords just before the start of a scan.

Our digital forensic specialist knows that as someone who used to go out and execute search warrants and conduct knock and talks, the ability to overcome and adapt on-scene is vital to a successful outcome. In this how-to video, Rich explains how to create a Collection Key without Search Profiles and how to add keywords prior to starting a scan from the Collection Key. 

ADF Solutions Releases New Digital Forensic Software to Power Field Investigations

Triage digital evidence with a single license for smartphones, tablets, and computers

ADF Solutions, the leading provider of automated forensic software for investigators and lab examiners, today announced new software versions for Digital Evidence Investigator^Ⓡ, Triage-Investigator^Ⓡ,  Triage-G2^Ⓡ, and Mobile Device Investigator^Ⓡ software.

This blog post will feature our Settings page, and tips and tricks to understanding it. The first thing users will notice on the settings page is the Backed-Up Licenses. This displays all licenses that have been backed up on this computer. When selecting a license it will display all the information pertaining to that license and also enable users to delete the license from the backed up licenses folder. Additionally, the information here can be used when making a support call or using the support portal.

We could have just written a mission statement. Maybe we’d throw in some core values, and hit you with some motivational quotes from great thought leaders. We could have done that, but that’s not the ADF way. ADF is an innovator, so we took those ideas and went further. Meet our Culture Code: a living, breathing set of standards, principles, values, and goals that we put our hearts and souls into as a team, because we are #AllinForensics. 

Our newest How-To video will cover how to image from either the Desktop tool or the USB device (Collection Key) on a Boot and Live Scan. 

When using ADF tools to collect files, either by File Properties, Hashes, or Keywords, ADF tools provide  three methods for file identification:

With ADF digital forensic software tools, it's possible to scan multiple devices simultaneously and have them as part of one scan. However, there are some items we need to keep in mind when preparing to scan multiple devices.

Triage- the word is normally associated with hospitals, where doctors and nurses prioritize patients’ treatments based on the severity of their condition. The concept has been around since the Napoleonic wars and is responsible for saving innumerable lives ever since.

When your case is complete and it comes time to archive your case,  the best method is to archive with the Stand Alone Viewer, located within reporting.

Software updates are something we look forward to, and when we receive that new download from our go-to tool, it makes the day even more special.  When it comes time to upgrade or re-install ADF software, as a user, you do not want your data to be lost after either the software upgrade or when selecting a new Search Profile folder.

When you first start the ADF application you will notice the tool will look to see if any new data needs to be merged or migrated.

With the ever-increasing amount of digital photo evidence, it's nearly impossible for investigators to quickly review photo evidence in a timely manner. Enter ADF Photo Probability for on-scene triage and digital investigations; one of the ways that ADF helps reduce the "noise" in a case and helps you get to the evidence faster.

ADF digital forensic software comes with approximately a dozen out-of-the-box default search profiles designed to make it quick and easy for non-technical field investigators to quickly search for digital evidence. 

In this short How To video, digital forensic specialist Rich Frawley, will show you how to collect and share digital evidence files with prosecutors and third parties using ADF Software. This video is ideal for learning how to share evidence with prosecutors for review. 

In this short 4-minute Mac forensics "How To" video, ADF forensic specialist, Rich Frawley, shows you how to conduct a boot scan of a MacBook Air with APFS & FileVault2 enabled.

Digital Evidence Investigator is built for front-line field investigators and lab examiners who need to do digital forensic investigations on Mac, Linux, or Windows. Combined with Mobile Device Investigator, Digital Evidence Investigator PRO gives you all the best computer forensic capabilities along with iOS and Android mobile forensics in a single affordable forensic tool. 

In this short video ADF's Digital Forensic Specialist, Rich Frawley, demonstrates the installation process for DEI and DEI PRO, on an offline computer that does not have Internet access. You can refer to our Technical Specifications for minimum requirements and supported Operating Systems.

Digital Evidence Investigator is built for front-line field investigators and lab examiners who need to do digital forensic investigations on Mac, Linux, or Windows. Combined with Mobile Device Investigator, Digital Evidence Investigator PRO gives you all the best computer forensic capabilities along with iOS and Android mobile forensics in a single affordable forensic tool. 

In this short video ADF's Digital Forensic Specialist, Rich Frawley, demonstrates the installation process for DEI and DEI PRO, on a computer that has Internet access. You can refer to our Technical Specifications for minimum requirements and supported Operating Systems.

Fast investigations require rapid access to evidence. ADF software enables investigators to quickly view the links of artifacts captured from a target device so you can easily understand a user's activities.