Global Standardization of Forensics will Decrease the Bias Factor of Evidence Collection Procedures and Court Rulings

Interviews – 2018

Angus Marshall, Digital Forensic Scientist

via Angus Marshall
Angus, tell us a bit about yourself. What is your role, and how long have you been working in digital forensics?

Where to begin? I have a lot of different roles these days, but by day I’m a Lecturer in Cybersecurity – currently at the University of York, and also run my own digital forensic consultancy business. I drifted into the forensic world almost by accident back in 2001 when a server I managed was hacked. I presented a paper on the investigation of that incident at a forensic science conference and a few weeks later found myself asked to help investigate a missing person case that turned out to be a murder. There’s been a steady stream of casework ever since.

I’m registered as an expert adviser and most of my recent casework seems to deal with difficult to explain or analyse material. Alongside that, I’ve spent a lot of time (some might say too much) working on standards during my time on the Forensic Science Regulator’s working group on digital evidence and as a member of BSI’s IST/033 information security group and the UK’s digital evidence rep. on ISO/IEC JTC1 SC27 WG4, where I led the work to develop ISO/IEC 27041 and 27042, and contributed to the other investigative and eDiscovery standards.

You’ve recently published some research into verification and validation in digital forensics. What was the goal of the study?

It grew out of a proposition in ISO/IEC 27041 that tool verification (i.e. evidence that a tool conforms to its specification) can be used to support method validation (i.e. showing that a particular method can be made to work in a lab). The idea of the 27041 proposal is that if tool vendors can provide evidence from their own development processes and testing, the tool users shouldn’t need to repeat that. We wanted to explore the reality of that by looking at accredited lab processes and real tools. In practice, we found that it currently won’t work because the requirement definitions for the methods don’t seem to exist and the tool vendors either can’t or won’t disclose data about their internal quality assurance.

The effect of it is that it looks like there may be a gap in the accreditation process. Rather than having a selection of methods that are known to work correctly (as we see in calibration houses, metallurgical and chemical labs etc. – where the ISO 17025 standard originated) which can be chosen to meet a specific customer requirement, we have methods which satisfy much fuzzier customer requirements which are almost always non-technical in nature because the customers are CJS practitioners who simply don’t express things in a technical way.

We’re not saying that anyone is necessarily doing anything wrong, by the way, just that we think they’ll struggle to provide evidence that they’re doing the right things in the right way.

Where do we stand with standardisation in the UK at the moment?

Standardization is a tricky word. It can mean that we all do things the same way, but I think you’re asking about progress towards compliance with the regulations. In that respect, it looks like we’re on the way. It’s slower than the regulator would like. However, our research at York suggests that even the accreditations awarded so far may not be quite as good as they could be. They probably satisfy the letter of the regulator’s documents, but not the spirit of the underlying standard. The technical correctness evidence is missing.

ISO 17025 has faced a lot of controversy since it has been rolled out as the standard for digital forensics in the UK. Could you briefly outline the main reasons why?

Most of the controversy is around cost and complexity. With accreditation costing upwards of £10k for even a small lab, it makes big holes in budgets. For the private sector, where turnover for a small lab can be under £100k per annum, that’s a huge issue. The cost has to be passed on. Then there’s the time and disruption involved in producing the necessary documents, and then maintaining them and providing evidence that they’re being followed for each and every examination.

A lot of that criticism is justified, but adoption of any standard also creates an opportunity to take a step back and review what’s going on in the lab. It’s a chance to find a better way to do things and improve confidence in what you’re doing.

In your opinion, what is the biggest stumbling block either for ISO 17025 specifically, or for standardizing digital forensics in general?

Two things – as our research suggests, the lack of requirements makes the whole verification and validation process harder, and there’s the confusion about exactly what validation means. In ISO terms, it’s proof that you can make a process work for you and your customers. People still seem to think it’s about proving that tools are correct. Even a broken tool can be used in a valid process, if the process accounts for the errors the tool makes.

I guess I’ve had the benefit of seeing how standards are produced and learning how to use the ISO online browsing platform to find the definitions that apply. Standards writers are a lot like Humpty Dumpty. When we use a word it means exactly what we choose it to mean. Is there a way to properly standardise tools and methods in digital forensics?

It’s not just a UK problem – it’s global. There’s an opportunity for the industry to review the situation, now, and create its own set of standard requirements for methods. If these are used correctly, we can tell the tool makers what we need from them and enable proper objective testing to show that the tools are doing what we need them to. They’ll also allow us to devise proper tests for methods to show that they really are valid, and to learn where the boundaries of those methods are.

Your study also looked at some existing projects in the area: can you tell us about some of these? Do any of them present a potential solution?

NIST and SWGDE both have projects in this space, but specifically looking at tool testing. The guidance and methods look sound, but they have some limitations. Firstly, because they’re only testing tools, they don’t address some of the wider non-technical requirements that we need to satisfy in methods (things like legal considerations, specific local operational constraints etc.).

Secondly, the NIST project in particular lacks a bit of transparency about how they’re establishing requirements and choosing which functions to test. If the industry worked together we could provide some more guidance to help them deal with the most common or highest priority functions.

Both projects, however, could serve as a good foundation for further work and I’d love to see them participating in a community project around requirements definition, test development and sharing of validation information.

Is there anything else you’d like to share about the results?

We need to get away from thinking solely in terms of customer requirements and method scope. These concepts work in other disciplines because there’s a solid base of fundamental science behind the methods. Digital forensics relies on reverse-engineering and trying to understand the mind of a developer in order to work out how extract and interpret data. That means we have a potentially higher burden of proof for any method we develop. We also need to remember that we deal with a rate of change caused by human ingenuity and marketing, instead of evolution.

Things move pretty fast in DF, if we don’t stop and look at what we’re doing once in a while, we’ll miss something important.

Read Angus Marshall’s paper on requirements in digital forensics method definition here. Angus Marshall

The hottest topic in digital forensics at the moment, standardisation is on the tip of everyone’s tongues. Following various think pieces on the subject and a plethora of meetings at conferences, I spoke to Angus Marshall about his latest paper and what he thinks the future holds for this area of the industry. You can […]

via Angus Marshall talks about standardisation — scar

Advertisements

Computer Forensics: Data Recovery & Extraction from Scratched Hard Drives via Salvation DATA Blog

[Case Study] Computer Forensics: Data Recovery & Extraction From Platter Scratched Hard Drives. COMPUTER FORENSICS:
Editor’s note: As a forensic data recovery expert, Salvation DATA receives different data recovery cases every day. Our forensic customers usually turn to us for help when they run into a case they are not able to handle. And among all the data lost situations, platter scratch is one of the most difficult kinds of problem to deal with. So in this issue, let’s see what is the correct forensic process for a platter scratched hard drive.

What is platter scratch?

When platters are damaged it is usually in the form of scratching caused by debris and or the read/write heads when they come in contact during the reading-writing process.

This is also known commonly as a head crash, although that term is often mistakenly used by inexperienced individuals to relate to clicking drives or hard drives that need a read/write head replacement.

Once the platters are scratched to a certain degree this will, in turn, damaged the read/write heads and will render the drive unreadable. Oftentimes this results in a clicking, scratching, chirping, or screeching sounds. However, these sounds don’t automatically mean the platters are scratched.

When the platters are scratched in this manner the drive will not be able to be recovered, the files and data contained on the drive will be lost forever. This is known as a catastrophic head crash and most hard drive failure recovery cannot fix this.

SalvationDATA Computer Forensics Scratched Platters

How to work with a hard drive with platter scratch?

Is platter scratch truly unrecoverable? Actually sometimes if the scratches to the platter surface are not too severe, there is still the possibility to recover and extract the data as long as we strictly follow operating procedures.

Stop attempting to read data immediately to avoid further unrecoverable damage.
Open the hard drive in a dust-free environment and inspect for damage.
Remove the damaged read/write head, and replace it with a healthy head. Donor head must be selected by strict matching rule. For example, for Western Digital head replacement, donor drive must match the model number, batch ID, FW version and PN.
After repairing physical damages, we can continue to forensically recover and extract the data from this hard drive with SalvationDATA’s DRS (Data Recovery System).
What tools do you need for this process?

HPE Pro is a hard drive repair tool Head Platter Exchange it is the unarguable and the only equipment built to handle head stack and drive motor issues, in case the drive corruption is not caused by firmware but head stack or drive spin motor. With the pioneer platter exchanger, it can prevent the head from further damage or misalignment due to incorrect operations to maintain the user data intact.

DRS (Data Recovery System) is our next generation intelligent all-in-one forensic data recovery tool that can acquire and recover data from both good and damaged storage media like HDD simply and easily.

Forensic Diagnostics

How do we know if the hard drive is fixed, and can continue to the next step? DRS’s disk diagnostics feature perfectly helps to solve the problem. DRS is able to scan the source disk in advance. With fairly new FastCheck technology, it allows rapid check within 5 seconds, avoiding the risk of second damage made to an important evidentiary storage device.

Insert the hard disk in DRS, and simply click the one-key Diagnose function to complete the process. DRS will tell you the detailed disk health status in no time!

2

Forensic Imaging

After repairing the physical damages, the hard drive could still be fragile and easy to fail again. If not handled with care, we may permanently lose the opportunity to recover and extract the data. Therefore, it is crucial to first secure data stored on the hard drive. DRS also provides the solution. The forensic imaging function of DRS secures the evidentiary digital data by creating a physical level sector-by-sector duplication of the damaged hard drive. Once finished, a forensic image will be exactly the same as the source data and can be stored safely and analyzed at any time appropriate.

3

Important notes:

When dealing with a defective hard drive as in this case, it is recommended to use the Advanced Imaging mode in DRS to help bypass bad sectors and extract as much data as possible. Also, remember to set transmission mode as PIO (low speed) to safely extract the data from such damaged storage device.
Before imaging, we can also check the raw hexadecimal data view in DRS Sector View to make sure data on this damaged hard drive is accessible. Professional data recovery engineers can even acquire more information from this sector view.
SalvationDATA Computer Forensics Scratched Platters

Forensic Recovery

Now with all the problems dealt with, we have one final step to make: recover and extract valuable evidentiary data. Use DRS’s File Recovery & File Carving function to locate and extract important digital files, and generate a forensic report at the end of the process. With DRS’s intelligent recovery technology, investigators can deal with deleted files, formatted partitions, corrupted file system and many other digital data lost situations without any professional skill requirements!

5

Conclusions

Platter scratch is the nightmare for data recovery engineers. However, it is not impossible to recover data from scratched platters. In this issue, we discussed the standard operating procedure to deal with a hard drive with platter scratch to maximize the possibility to recover and extract valuable evidentiary data. We hope the instructions we provide can help you with your work!
You can also visit our official YouTube channel for more videos: https://www.youtube.com/user/SalvationDataOfficia/featured

https://videopress.com/embed/MiSnIzf7?hd=0&autoPlay=0&permalink=0&loop=0

Editor’s note: As a forensic data recovery expert, SalvationDATA receives different data recovery cases every day. Our forensic customers usually turn to us for help when they run into a case they are not able to handle. And among all the data lost situations, platter scratch is one of the most difficult kinds of problem […]

via [Case Study] Computer Forensics: Data Recovery & Extraction From Platter Scratched Hard Drives — SalvationDATA Blog

8 Reasons Why I love Forensics via Emily Leong

I get to talk about topics that matter to me

In forensics, I get to choose the topics for all my speeches. This means that they’re very personal and matter a lot to me. Issues like racism, homophobia, and gun control are all topics I’ve done speeches on. Being able to have a space to express my opinions, and to hear other opinions has been really empowering for me.

I can express myself

Forensics isn’t just all formal speeches. Most of the events I do is under the interpretation genre, meaning that my speeches are more like acting than formal informative or persuasive speeches. Being able to express myself through my speeches has been a great stress reliever for me.

Creativity

Being in interpretation events, I get to have a bigger creative licence with my speeches. This allows me to get creative with what I do with my movements and gestures. This creative side of forensics turns words into art.

Life Skills

Through this activity, I’ve developed the important life skill of public speaking. Many people who have not done forensics fear public speaking, but because I have grown such an affinity for it, speeches, and class presentations are much easier, and come quite natural to me.

Community

I have met so many wonderful people through this activity. Most of my closest friends are on my team, and I’ve met so many beautiful people from other teams who are so inspiring, beautiful, and kind.

State Team Goofy

I stay informed

Most topics in Forensics are about either politics or current events. This means that I am not informed during tournaments, but motivated to read and watch more news, and stay current outside of tournaments. Staying informed on current events now has become important to my daily life.

Travel

Especially in college, forensics is a great way to travel to new places. The spring of 2018, my team traveled to Nashville, Tennessee for the Pi Kappa Delta national tournament. It was great to explore the city, and I can’t wait to have the opportunity to travel more.

Confidence Booster

Forensics has helped be able to accept constructive criticism, which is something a lot of people need to work on. It also has allowed me to feel good about the work I put into each and every one of  my speeches. Forensics has given me a space where I feel confident about myself.

Suits

Of course, a proper team is not complete without the proper attire. Suits are the norm at tournaments, and if you dig around enough on Ebay or at Goodwill, you’re able to find some great pieces. Suits can be a great conversation starter with another competitor. A good suit is essential for forensics.

Ecc Tessa Suit

 

I get to talk about topics that matter to me In forensics, I get to choose the topics for all my speeches. This means that they’re very personal and matter a lot to me. Issues like racism, homophobia, and gun control are all topics I’ve done speeches on. Being able to have a space to […]

via 8 Reasons Why I love Forensics — Emily Leong

Autopsy of a Dill Pickle-Introductory Lab for Anatomy or Forensics!

A Pickle Autopsy? YES!

If you teach Anatomy & Physiology, you know the struggle of the first unit…. it’s HUGE!! … and jam-packed with things that are absolutely essential for students to know in order to be successful in the course.  I usually struggle with finding activities to review the body cavities and directional terms.  This year, someone suggested using the pickle autopsy and I’m so glad I did!

The lab I used was published in The Forensic Teacher and would be appropriate for either discipline (I teach both this year).  Here is the link to the lab I used http://www.theforensicteacher.com/Labs_files/picklelabsheets.pdf  A clever fellow teacher friend came up with the storyline that there was a gang war between the Claussens and the Vlasics in the fridge that resulted in no survivors. I loved it so I also used that storyline to frame my lab.

Set Up– The Basics

Now that I had my lab picked out and my story to tell, I had to figure the logistics of how to get everything set up.

First, the pickles….

img_9918

I found the big jars of dills at Walmart for $5.97 each. The smaller pickles I got because I wanted some of my “victims” to be pregnant (or they could also be small children pickles lol).  I had a hard time estimating how many pickles were in the big jars, but these 2 had a total of 33 pickles– more than enough for my classes. The picture below shows them separated by “male” and “female” victims (my “male” pickles are the ones with the stems lol).

Here are all the supplies I used for the lab: img_9916

How to make them look like victims….

I glued wiggly eyes onto thumbtacks for their eyes (so I can reuse them)img_9917

I also used pellets that go in pellet guns for bullet wounds (I smashed them a little with the hammer first and dipped them into gel food coloring before I stuck them in the “victims”)img_9922

I made their heads from an olive stuck on a toothpick– some I even squished so their “brains” fell out a little lol.  I also gave all of them a “spine” (a toothpick on the dorsal side just under the skin).  I also broke several of the toothpicks so this “injury” might be discovered and included in the story of their “victim”. img_9937.jpg

All the “victims” had a bead implanted in the vicinity of their heart.  If the bead was red, they had a normal heart.  If it was black or dark purple, it represented a heart attack.  I found that if you make a slit on the side of the pickle (choose a wrinkle), it will often be completely unnoticeable and students will wonder how in the world you got those beads in there!  I also slipped in a small green bead in the neck region of a few of the “victims” and told my students I heard that some of the gang members involved in the war were caught raiding the grapes from the fridge and several choked on them when their leader caught them.

I also told them that the gang members were not healthy and many had various diseases and disorders because they didn’t take care of themselves.  Many had white beads implanted in various areas.  These beads represented a tumor in the particular area.  Knotted pieces of rubber bands in the abdominal region represented parasites.  Many had broken toothpick “limbs”.  I also had several who were pregnant.

This is the sheet of “Helpful Hints” I gave my students with their lab:

img_9941

A Snapshot of My “Victims”

I separated my “victims” into 4 general types based on their cause of death:

  1. Trauma or internal bleeding (Stabbed or gunshot, injected with red food coloring)
  2. Poisoning/ Drug Overdose (I soaked them in baking soda but didn’t get a very good result)
  3. Heart Attack (black bead instead of red bead in chest)
  4. Drowning (blue food coloring injected in chest area)

 

My “victims” had multiple things that could have resulted in their deaths, but having 4 major things just helped me keep it organized. I also put them in separate dishes while I plotted their demise 🙂 img_9926

I also kept them separate in labeled gallon ziplock bags to transport them to school. img_9927

The Lab Set Up

I set my lab up as a mini crime scene.  I had some fake vampire blood from my forensics class that I also added to help set the scene.  I also added in some extra plastic swords and pellets around the “victims”.  (I let my students pick their own “victim” from the scene). img_9948

Group Jobs

Students were in a lab group of 3 per “victim”.  In my lab, every student in the group has a specific job and job description.  It just helps my lab groups run more smoothly and tends to decrease the possibility that one student does the lion’s share of work.  These are the jobs I gave my groups for this lab: img_9936.jpg

My Take on the Pickle Autopsy Lab

Would I use it again? Absolutely!  My students became very proficient at actually using the directional terminology and identifying the body cavities that we talked about in class.  I heard many meaningful conversations within the groups… “That’s a break in his arm that’s intermediate between the shoulder and the elbow” “I think this sword went through the abdominal cavity and not the thoracic cavity”…. This was so much better than hearing them try to memorize a diagram or a chart of the directional terms!

They loved getting into our “gang warfare” story.  I had them fill out a Coroner’s Report detailing the abnormalities they found both in, and on their “victim”, as well as the location of these abnormalities.  Then, they had to determine the cause of death for their victim, supporting their opinion with specific details from their autopsy.  At all times within their report, they had to incorporate correct anatomical terminology.  Finally, they had to create a narrative of what happened to their “victim” based on the findings from their autopsy.  Several groups shared with the class.  It was lots of fun!

 

 

A Pickle Autopsy? YES! If you teach Anatomy & Physiology, you know the struggle of the first unit…. it’s HUGE!! … and jam-packed with things that are absolutely essential for students to know in order to be successful in the course. I usually struggle with finding activities to review the body cavities and directional […]

via Autopsy of a Dill Pickle- A Great Introductory Lab for Anatomy or Forensics! — Edgy Instruction

Forensic psychology with an emphasis on prison-based rehabilitation is the focus of the Corrective Services 7th Annual Psychology Conference on 29-30 August. Keynote speaker Professor Jim Ogloff AM from @swinburne will discuss ways to reduce violence & serious sexual offending.pic.twitter.com/UmYrol3Yrj — Site Title

Forensic psychology with an emphasis on prison-based rehabilitation is the focus of the Corrective Services 7th Annual Psychology Conference on 29-30 August. Keynote speaker Professor Jim Ogloff AM from @swinburne will discuss ways to reduce violence & serious sexual offending. pic.twitter.com/UmYrol3Yrj Forensic psychology with an emphasis on prison-based rehabilitation is the focus of the Corrective […]

via Forensic psychology with an emphasis on prison-based rehabilitation is the focus of the Corrective Services 7th Annual Psychology Conference on 29-30 August. Keynote speaker Professor Jim Ogloff AM from @swinburne will discuss ways to reduce violence & serious sexual offending.pic.twitter.com/UmYrol3Yrj — Site Title