The last post was by Holly, and she wrote on concerns on the distribution of knowledge and people committing crime with this knowledge. The issue is also true the other way around, since we have to exchange knowledge, and have our methods peer reviewed in journals, so use them in court. In many countries legislation exist to shield the information such that it is not used for committing crime, and still the evidence can be used in court. It is also the reason that often events are organized for law enforcement only in this field.
Within FIDIS www.fidis.net where I am involved in the package on forensic science, another issue is mainting privacy, since people seem to store lots of information on the internet without realizing that other people can also use it in the future, and one should be aware that even if information is erased, it is often available on backups, so it is also something to be aware of. As we see with the latest developments on the mobile phone (for example latitude of google), also the location of where you are, is visible on the net. With these systems you give permission, and even I tend to use these features, since it can be a nice gadget.
I am looking forward to the meeting of the American Academy of Forensic Science in Denver. I organized a workshop, and we have the first year of our new group in Digital Evidence and Multimedia, where I am currently chairperson of. I will also give a paper on camera identification and ENF.
In August we also organize a workshop the Third International Workshop on Computational Forensics at the Netherlands Forensic Institute, The Hague, The Netherlands [August 13-14, 2009]. Currently there is a call for papers, so we are looking forward to this. It is in conjuction with IAPR and there should be paper proceedings ready by Springer in August.
Saturday, February 07, 2009
To Catch a Thief…
There’s an old adage that says that it takes a thief to catch a thief, a saying that leads us to believe that every cop, detective or any other person in law enforcement who’s any good at their job must have a mind that has a little bit of a criminal bent. Unfortunately, the reverse is also true – every criminal who does not want to be caught, ultimately masters the art of covering his tracks and staying just out of reach of the long arm of the law.
Computer forensics is a not just a science, but an art as well – for those who have the innate skills to handle the tasks that go with this field, no technology is too complicated and no thief too difficult to catch. The real problems begin when the criminals begin to use forensics too, not to catch others of their kind, but to sweep away evidence of their crimes and leave nothing behind for the investigators who are sure to follow their tracks.
The age of the computer and the rapid advances we are making in the field of technology is something that would never have been thought possible a few decades ago. It’s this advancement that has made criminals out of some of us – the lure of easy money and the possibility of an almost certain escape is too good an opportunity to pass up for those who don’t have too many ethics or moral values; and this is why we have people breaking into networks and security systems to access credit card and other personal and sensitive information.
Today, while it’s true that the good guys have an arsenal of forensic tools at their disposal to help catch the bad guys, it’s also true that the bad guys are becoming really good at beating the good guys at their own game. They’re going back to school too, so that they can learn the tools of the computer forensic trade in the legitimate way, and then use these methods to prevent and avoid detection.
There are criminals who perpetrate crime when the opportunity presents itself; and there are those who religiously plan and execute their crimes. For the latter kind, nothing is too hard or too difficult. They’re often master strategists who are adept at hiding their tracks and moving from one operation to the other to avoid being caught. And this makes computer forensics a more challenging field – how do we prevent the knowledge that’s available from being misused?
Besides the legitimate forensic tools, there are those that straddle the thin line between legal and illegal; and when these are used in conjunction with those that are allowed to be used, they form the most lethal combination because they trick users into believing that the whole operation is legit.
If education is knowledge and knowledge is power, then we must ensure that this power does not fall into the wrong hands. For when it does, there’s nothing we can expect but disaster on a large scale.
By-line:
This post was contributed by Holly McCarthy, who writes on the subject of forensic science careers. She invites your feedback at hollymccarthy12 at gmail dot com
Computer forensics is a not just a science, but an art as well – for those who have the innate skills to handle the tasks that go with this field, no technology is too complicated and no thief too difficult to catch. The real problems begin when the criminals begin to use forensics too, not to catch others of their kind, but to sweep away evidence of their crimes and leave nothing behind for the investigators who are sure to follow their tracks.
The age of the computer and the rapid advances we are making in the field of technology is something that would never have been thought possible a few decades ago. It’s this advancement that has made criminals out of some of us – the lure of easy money and the possibility of an almost certain escape is too good an opportunity to pass up for those who don’t have too many ethics or moral values; and this is why we have people breaking into networks and security systems to access credit card and other personal and sensitive information.
Today, while it’s true that the good guys have an arsenal of forensic tools at their disposal to help catch the bad guys, it’s also true that the bad guys are becoming really good at beating the good guys at their own game. They’re going back to school too, so that they can learn the tools of the computer forensic trade in the legitimate way, and then use these methods to prevent and avoid detection.
There are criminals who perpetrate crime when the opportunity presents itself; and there are those who religiously plan and execute their crimes. For the latter kind, nothing is too hard or too difficult. They’re often master strategists who are adept at hiding their tracks and moving from one operation to the other to avoid being caught. And this makes computer forensics a more challenging field – how do we prevent the knowledge that’s available from being misused?
Besides the legitimate forensic tools, there are those that straddle the thin line between legal and illegal; and when these are used in conjunction with those that are allowed to be used, they form the most lethal combination because they trick users into believing that the whole operation is legit.
If education is knowledge and knowledge is power, then we must ensure that this power does not fall into the wrong hands. For when it does, there’s nothing we can expect but disaster on a large scale.
By-line:
This post was contributed by Holly McCarthy, who writes on the subject of forensic science careers. She invites your feedback at hollymccarthy12 at gmail dot com
Saturday, January 24, 2009
January 2009
January started good. The European network of Forensic Institutes was having a meeting on their Research and Development in Birmingham. When visiting Birmingham, it appeared that the prices where much lower than in the past, also caused by the exchange rate of the pound. It was nice to see that prices are reasonable again in England. I also had this experience when ordering some electronics in England with Ebay.
Within Europe we see that forensic science is developing in a market. In England and Wales, forensic science is more a market, and there is even a regulator. Also in the Netherlands a market is developing in forensic science, and this is progressing with different companies being active on the Dutch market. Of course, it has some challenges in quality assurance, however it is good to have more choice also when coping with backlogs, as long as the quality is also guaranteed of course.
This month I had to finish some publications and reviews. So as always busy, also with some work for the European Commission as an evaluator. Also doing some casework, and giving some presentations, as well as working on projects.
Within Europe we see that forensic science is developing in a market. In England and Wales, forensic science is more a market, and there is even a regulator. Also in the Netherlands a market is developing in forensic science, and this is progressing with different companies being active on the Dutch market. Of course, it has some challenges in quality assurance, however it is good to have more choice also when coping with backlogs, as long as the quality is also guaranteed of course.
This month I had to finish some publications and reviews. So as always busy, also with some work for the European Commission as an evaluator. Also doing some casework, and giving some presentations, as well as working on projects.
Sunday, December 28, 2008
December 2008 (2)
With Christmas I received this photograph of the mariage of my grandmother and grandfather in 1929. I like these photographs since they are sometimes more futuristic then one expects.The end of December is always quiet, since deadlines still can be made before January 1st. I am also doing some evaluation work for the European Commission, and furthermore a new salary model will be implemented at our Institute, where a specialist does not need to be in management to get a higher scale anymore.
I also had to witness in court since the court expected me to do miracles with image processing such is seen in CSI. The issue is as always that I can not make anymore detail in a forensic proper way then is visible on pixel level. This time I had to answer the same kind of questions many times, however in the verdict it became clear that they understood the issue. Recognition of a person is different from identification. I always learn also from the expert witness testimonies. Sometimes they also give advise on how to write technical issues clearer for people that are specialised in law.
It is an issue in writing technical reports for the court, that we have to understand each other well, and sometimes word in technical context might mean something different for a lawyer or a judge. It is always good to be aware of these things.
On another topic currently we are working for FIDIS, and there we make some more open source products. For comparing pictures, the the NFI Comparator has been changed to .net since it will make things more stable (however not workable anymore under other operating systems as was our previous java-implementation. Also the defraser software is expanding now, and currently a new version of PRNU compare is being made which is expected to be available on line in February with implementation of wavelet filtering as described in literature by Fridrich and others. And finally we will also have an ENF-collector available for recording the variations of the 50 Hz-signal which sometimes can be used to find when a certain recording has been made. The ie
On these subjects I will also speak at the conference of the American Academy of Forensic Sciences in Denver. Where I am also happy that we have our first year of the Digital Evidence and Multimedia-section, where I am currently chairman of.
Sunday, November 30, 2008
December 2008
I just came back from a week vacation in the Middle East and then it appeared that Zeno's Forensic Site was suspended for several days due to someone abusing one of the cgi-scripts (indeed hackers seem to develop better tools to be unrecognised). When returning back from my vacation I had a delay of two days due to bad weather in Europe. So, now everything is fixed again, however I learn that it is always wise to monitor everything constantly. And of course, I also have to make backups of the ever expanding website. And after a week of vacation I can start again with a fresh mind.
At my work we had some nice results with the research projects. Several people are working on the projects I wrote on before, such as ENF and PRNU, also for FIDIS. I think we will make also new developments on these open source. And finally the encyclopedia got finished, so thanks to all, I think it will be published in 2009.
Also in European FP7 projects more forensic topics are included, so it appears to work fine. Furthermore I have some backlog with publications etc, however that is the way life is, since casework is first. Next Wednesday I have to go to court to testify as an expert witness in a case.
At my work we had some nice results with the research projects. Several people are working on the projects I wrote on before, such as ENF and PRNU, also for FIDIS. I think we will make also new developments on these open source. And finally the encyclopedia got finished, so thanks to all, I think it will be published in 2009.
Also in European FP7 projects more forensic topics are included, so it appears to work fine. Furthermore I have some backlog with publications etc, however that is the way life is, since casework is first. Next Wednesday I have to go to court to testify as an expert witness in a case.
Sunday, October 26, 2008
October 2008 (2) by Kelly Kilpatrick
Kelly Kilpatrick asked me if she could contribute to this blog with a guest article, and of course I am happy to do so.
5 Computer Forensics Blogs Worth Investigating
The field of computer forensics is constantly changing and evolving due to its inherent nature. Those who are tracked and investigated using forensic methods involving computers are usually trying to stay ahead of the curve, finding new and improved ways to evade their pursuers.
Computer forensics professionals work in a variety of settings, locations, and institutions for different groups that require their services and many of these professionals maintain blogs with news, tips, and advice for their colleagues. Here a few good computer forensics blogs that are worth a look.
Computer Forensics/E-Discovery Blog: This blogger works hard to share information, tips and tricks on a variety of issues related to the field of computer forensics. His proprietary software, Drive Prophet, has been tested by regular visitors to his blog and will be on the market soon. The software will be able to run many reports based on the drive in question and will help maximize time used when investigating hard drives.
Computer Forensics, Malware Analysis, and Digital Investigations: For extremely detailed explanations of a variety of procedures used by computer forensics experts, take a look at this blog. Simple, easy-to-use steps are part of this blogger’s way of giving back to the online computer forensics community. Browse the archives for specific tips you may be looking for.
Forensic Incident Response Blog: If you are interested in real-life scenarios in computer forensics and the proper way to deal with these scenarios, visit the Forensic Incident Response Blog. The protocols for various situations are laid out, including some tips on the latest in remote disk image analysis. Visit this blog for more information.
A Day in the Life of an Information Security Investigator: This blog is full of real world scenarios and advice from a self-proclaimed digital security guru. The blogger has worked for various technological, financial, and military institutions and has a wealth of knowledge to share on a wide array of topics. Browse through his archives and see what you can learn from the Security Monkey.
Forensic Computing: The Forensic Computing blog is a great one that examines the intricate relationship between computer science, information technology, and information security—as they all work together from the perspective of a computer forensic scientist. Looking at these details and how they work in helping to break down the processes utilized by criminals in real world applications is central to the blog. Discussion of digital evidence and admissibility, along with tips and advice make this blog worth a read.
By-line:
This post was contributed by Kelly Kilpatrick, who writes on the subject of the benefits of degree in corrections. She invites your feedback at kellykilpatrick24 at gmail dot com
5 Computer Forensics Blogs Worth Investigating
The field of computer forensics is constantly changing and evolving due to its inherent nature. Those who are tracked and investigated using forensic methods involving computers are usually trying to stay ahead of the curve, finding new and improved ways to evade their pursuers.
Computer forensics professionals work in a variety of settings, locations, and institutions for different groups that require their services and many of these professionals maintain blogs with news, tips, and advice for their colleagues. Here a few good computer forensics blogs that are worth a look.
Computer Forensics/E-Discovery Blog: This blogger works hard to share information, tips and tricks on a variety of issues related to the field of computer forensics. His proprietary software, Drive Prophet, has been tested by regular visitors to his blog and will be on the market soon. The software will be able to run many reports based on the drive in question and will help maximize time used when investigating hard drives.
Computer Forensics, Malware Analysis, and Digital Investigations: For extremely detailed explanations of a variety of procedures used by computer forensics experts, take a look at this blog. Simple, easy-to-use steps are part of this blogger’s way of giving back to the online computer forensics community. Browse the archives for specific tips you may be looking for.
Forensic Incident Response Blog: If you are interested in real-life scenarios in computer forensics and the proper way to deal with these scenarios, visit the Forensic Incident Response Blog. The protocols for various situations are laid out, including some tips on the latest in remote disk image analysis. Visit this blog for more information.
A Day in the Life of an Information Security Investigator: This blog is full of real world scenarios and advice from a self-proclaimed digital security guru. The blogger has worked for various technological, financial, and military institutions and has a wealth of knowledge to share on a wide array of topics. Browse through his archives and see what you can learn from the Security Monkey.
Forensic Computing: The Forensic Computing blog is a great one that examines the intricate relationship between computer science, information technology, and information security—as they all work together from the perspective of a computer forensic scientist. Looking at these details and how they work in helping to break down the processes utilized by criminals in real world applications is central to the blog. Discussion of digital evidence and admissibility, along with tips and advice make this blog worth a read.
By-line:
This post was contributed by Kelly Kilpatrick, who writes on the subject of the benefits of degree in corrections. She invites your feedback at kellykilpatrick24 at gmail dot com
Sunday, October 05, 2008
October 2008
Starting with the ENFSI meeting in Madrid, the forensic IT working group meeting, it was an excellent start of the month. Many new developments were presented in the different fields, and the organisation in Madrid was excellent.
The week before we had a FIDIS meeting in Dresden, and that was also very nice, so we can work further on PRNU also perhaps on sourceforge. We tried to link the different videos in Youtube with PRNU, however it did not work well yet, perhaps due to compression.
Also casework is going on. When I was in Madrid, I received an invitation to testify in court on a case, however this was such a short notice, that it was not feasible anymore.
Also enough new developments in the organisation, so it looks like a busy month.
The week before we had a FIDIS meeting in Dresden, and that was also very nice, so we can work further on PRNU also perhaps on sourceforge. We tried to link the different videos in Youtube with PRNU, however it did not work well yet, perhaps due to compression.
Also casework is going on. When I was in Madrid, I received an invitation to testify in court on a case, however this was such a short notice, that it was not feasible anymore.
Also enough new developments in the organisation, so it looks like a busy month.
Subscribe to:
Posts (Atom)