Downloaded 48 times
Uploaded byCellebrite
Reduce Lab Backlog with Mobile Data Forensic Previews
The document discusses the increasing use of mobile devices in forensic investigations and the challenges posed by traditional evidence collection methods. It suggests a multi-tiered model that enhances evidence collection at the scene, improves efficiency, and reduces backlog while ensuring the quality of evidence submitted for analysis. The implementation of educational programs, engineering solutions, and enforcement policies are essential for maximizing the effectiveness of mobile forensics and improving public safety.
More Related Content
Reduce Lab Backlog with Mobile Data Forensic Previews
- 1. Reducing Backlog: Mobile ForensicPreviews Lee Papathanasiou Cellebrite: Sales Engineer, Forensics
- 2.
- 3. *As of January2014: 90% of American adults have a cell phone 58% of American adults have a smart phone 32% of American adults own an e-reader 42% of American adults own a tablet Multi-Device Environment Source: Pew Research Center http://www.pewinternet.org/
- 4. Volume & Complexityof Data
- 5. Volume & Complexityof Data
- 6. Mobile Device ExamsIncrease Statistics from three cities in North America anecdotally* show a steady increase in the ratio of mobile forensic exams to computer exams starting from 2005 to present. *No standards exist for the tracking of forensic lab statistics, so not all labs report the same way. In addition, labs’ own reporting may be inconsistent from year to year. Other variables, such as trends in investigations themselves, have not been accounted for.
- 7. Mobile Forensics: A TeamEffort
- 8. Today’s model ofmobile device evidence collection ■ Forensic Examiner performs extraction & analysis at the Lab ■ First Responder Secures Scene ■ Investigator Seizes Evidence: “Bag and Tag”
- 9. Limitations of CurrentModel ■ Actionable information NOT available to First Responder o Result: Opportunity for time-sensitive decisions is missed which could mean the difference between Life and Death ■ Evidence becomes more vulnerable the longer it sits at scene o Result: Evidence on the device is remotely Wiped/Deleted ■ The importance of evidence is not identified or qualified at scene o Result: Lack of insight leads to collection of unnecessary evidence and directly contributes to EVIDENCE BACKLOG! ■ Field personnel are not being utilized to their full capacity o Result: The inefficient use of resources is an unnecessary Waste of Money ■ Forensic Examiners are spending valuable time on basic evidence collection o Result: Less time available to focus on the deeper/complex examinations which can yield important evidence & deleted information. This amounts to a Waste of Talent.
- 10.
- 11.
- 12.
- 13.
- 14. Multi-Tiered Model ReducesBacklog! ■Increases Quality of evidence in lab ■Empowers existing personnel with mobile forensic technology ■Enables rapid evidence collection & preview in field ■Decreases Quantity of evidence in field ■Result: More Leads in Less Time
- 15. Use Cases thatcan Benefit ■Monitoring Probation/Parole ■Child Abuse Image Investigations ■Drug Interdiction ■Substantiate Victim Claims ■List goes on…
- 16. Implementation Requirements: EEE ■Education■Engineering■Enforcement
- 17. ■Data collection &review contributes to officer/civilian safety Education: Academy Level ■Eliminate & Prevent Intimidation ■Academy Curricula needs to be prioritized & updated ■SOP & Training need to compliment each other
- 18. Education: Field Level ■EvidenceHandling & Collection ■Establish guidelines for escalations to lab (i.e. Prosecution over Intel, Felonies over Misdemeanor) ■Incorporate 15 min hands-on training during briefings ■Keep current with warrant templates, preservation letters, etc.
- 19. ■Types of EvidenceCollected: Textual Data and/or Media Files? (Dictates bandwidth & storage capacity needed) Engineering: Data Management Infrastructure ■Decide on method of transferring and/or storing evidence ■Need to maintain Chain of Custody and Integrity of data ■Remote Storage: Secure 4G/WiFi connection. VPN Tunneling. ■Local Storage: Hard Drive/ Flash Drive/ SD Card – Logistics
- 20. ■Software must havebuilt-in reviewing & basic analysis capabilities Engineering: Mobile Forensic Solution ■Mobile forensics software solution needs to be flexible & easy to use ■Software needs to be able to support extraction from an immense variety of mobile devices in order to be effective ■A laptop/tablet or stand-alone forensic device will be required. Preferably semi or fully ruggedized with relatively small footprint
- 21. © 2014 CellebriteMobile Synchronization LTD, All rights reserved • Purpose built • Closed for other applications • No User maintenance • Extraction only UFED Touch • Multiple tools single platform • Full Cycle capabilities • HW upgrade at your own pace • Chose your platform – Flexibility UFED 4PC • Single source • Multiple tools single platform • Full Cycle capabilities • No user installation • Standalone and ruggedized UFED TK
- 22. © 2014 CellebriteMobile Synchronization LTD, All rights reserved UFED: Extract & Preview
- 23. ■SOP should setclear expectations for everyone involved including when to escalate devices to a forensic specialist Enforcement ■Controls need to be in place to prevent abuse ■Establish Policies as well as SOP to enforce training & evidence collection methodologies ■Software solution needs to of facilitate these requirements. User & Permission Management, Logs, Training verification
- 24. Enforce: UFED PermissionManager User Authentication and Permission Management ■ Profile defines authorized actions ■ By action ■ By data type (where applicable) ■ Profiles are assigned to Users ■ Import / Export Users list
- 25. ■Examples: Search Warrant Consent Probation/Parole Exigent Circumstances SearchIncident to Arrest Plain Sight Enforcement: Rules of Engagement ■Laws vary from state to state and are in constant flux ■Consult legal authorities to ensure adherence to law
- 26. Data Triage &Public Safety
- 27. Data Triage &Public Safety Traffic Accidents – Was the driver distracted by their phone? Where were they last? Time sensitive situations that can significantly benefit from mobile device collection at scene of incident: Active Shooter – Did they have accomplices? Abductions – Who was their abductor? Where were they last? Bomb Threats – Where is the bomb located? What is the detonation device?
- 28. This is onlythe Beginning!! ■Decision making in the field can be improved even further • Imagine collecting evidence from a mobile device on scene and then running that data against a database…. Fugitives Abductees Drug Terms Gang Members Terrorists Explosives Stolen VINs Etc…..
- 29. ■State & LocalFusion centers will have more diverse datasets to utilize which will increase situational awareness. Impact on Crime Prevention ■Mobile Device Evidence also has value downstream ■Intel & Crime Analysts benefit from high quality data ■The variety of data on mobile devices can contribute significantly to predictive analytics & crime prevention efforts
- 30.
Editor's Notes
- #31 A multi-tiered forensic model coupled with the right mobile forensic solution will reduce the growing backlog of evidence as well as the costs associated with it. Leveraging existing resources can shorten investigative cycles as well as increase efficiency in the field & in the lab. Our industry is rapidly evolving and we feel an obligation as the market leader to educate and prepare you for this paradigm shift. I think we can all agree that the industry is at an inflection point which requires us to adapt. By working together, we can meet the demands of this increasingly complex mobile forensics world. Thank you