Crime Scene Training

Manual Outlines Policies and Procedures for Digital Evidence

Electronic devices such as computers, cellphones and digital cameras must be properly seized, processed and stored to preserve the integrity of the data and ensure its evidentiary value. A manual developed by the Electronic Crime Technology Center of Excellence (ECTCoE) can provide agencies with much-needed guidance on drafting policies and procedures for handling digital evidence.

As stated in the text, the purpose of the sample Policy and Procedure Manual is to give law enforcement agencies a collection of documents that can serve as a starting point for developing policies and procedures for the collection, handling and processing of digital evidence. Once final, the manual will be posted to the National Law Enforcement and Corrections Technology Center (NLECTC) System website, in a Microsoft Word format to facilitate editing as needed by individual agencies. The NLECTC System is a program of the Office Justice Programs’ National Institute of Justice.

“The document was written in response to the many requests we’ve seen on the various computer forensic email lists requesting copies of policy and procedure 
manuals by state and local officers and agents who have been tasked with developing such a document for their own agency,” explains Russell Yawn, ECTCoE deputy director.

In developing the manual, the ECTCoE was able to take advantage of in-house expertise along with information gathered from law enforcement agencies.

“The ECTCoE deals with the law enforcement community at large so we have contacts throughout the country and some internationally that we can rely on for input,” says ECTCoE Director Robert O’Leary. “We have a well-established network and relied on that network to provide us with examples that agencies were using at the state level, and combined it with the expertise in the ECTCoE. Every CoE staff member has criminal justice experience with digital evidence collection and examination, so we were able to leverage all those resources and put together this set of policies and procedures.”

Some of the agencies that provided assistance include the Southern Oregon High Tech Crimes Task Force, the New York Police Department, Orlando Police Department, Austin Police Department, Dallas Police Department and Charleston Police Department. The ECTCoE also looked at sample policies from the U.S. Department of Defense.

“We were able to get a great deal of information from a number of agencies and contacts, and look at the policies that had been implemented and ensure that we did not overlook any topics or points of interest that other agencies may have found important,” O’Leary says.

The manual should also help agencies performing the Commission on Accreditation for Law Enforcement Agencies (CALEA) accreditation process regarding digital evidence procedures. The purpose of CALEA accreditation programs is to improve the delivery of public safety services, primarily by maintaining a body of standards and establishing and administering an accreditation process.

“Another thing we tried to keep in mind was the CALEA standards,” O’Leary says. “We wanted to ensure that these procedures would lend themselves to compatibility, and we were able to rely on some of our contacts that perform CALEA reviews.”

The manual has sections covering case assignment and prioritization; equipment testing, validation and updates; evidence and property handling; search and seizure; storage of evidence and retention policy; reports; materials and supplies; computer forensic lab access; Manual Outlines Policies and Procedures for Digital Evidence2 release of information to the media; quality assurance policy and process; and sample forms (e.g., computer lab request for service, evidence inventory and details, and evidence access and tracking).

“Some forms we developed, others are based on forms received from other agencies. We simply wanted to give agencies a format they could work with as a guide,” O’Leary says.

For more information, contact NLECTC at (800) 248-2742. For information on NIJ’s electronic crime technology portfolio, contact Program Manager Martin Novak at [email protected] or (202) 616-0630

Visit NLECTC's Interactive TechBeat.

Learn about new posts to this blog: Sign up for Email Alerts

 

What Happens to the Brain During Sexual Assault

Follow the transcript or watch the video of a Seminar with Becki Campbell - NIJ Event Update

In the latest Research for the Real World presentation, Dr. Rebecca Campbell discusses the neurobiology of sexual assault and the effect trauma has on victim behavior. Is she exhibiting normal post-trauma behavior? Or is she lying?

Dr. Campbell has given this presentation before numerous law enforcement officers. She has several tips that help officers make arrests and strengthen the case.

Rebecca Campbell is Professor of Psychology and Program Evaluation at Michigan State University. For the past 20 years, she has conducted victimology research and evaluation, with an emphasis on violence against women and children. Her work examines how rape crisis centers and the legal, medical, and mental health systems respond to the needs of adult, adolescent, and pediatric victims of sexual assault. Her current work, funded by the National Institute of Justice, focuses on Sexual Assault Nurse Examiner (SANE) programs and the criminal justice system.

Visit the NIJ website HERE

 

 

            Learn about new blog posts - Signup for Email Alerts

Market Survey on Through-the-Wall Sensors

The Sensor, Surveillance, and Biometric Technologies (SSBT) Center of Excellence (CoE) has undertaken a market survey of through-the wall sensors (TTWS) certified by the Federal Communications Commission (FCC) for operation by law enforcement and first responder agencies in the United States. These devices generally use a form of radar to detect small amounts of movement behind barriers; in some cases, the movement associated with normal breathing is enough to allow detection.

TTWS allow for enhanced situational awareness during operations when knowledge of the presence of individuals behind opaque barriers would be of benefit, during law enforcement operations requiring forced entry, in hostage situations, in building sweeps by firefighters or when locating individuals in rubble during search-and-rescue operations. Some devices provide a range to the moving target and others, a two-dimensional (2D) graphical display of multiple targets.

This report provides an unbiased survey of available equipment and its operational capabilities and limitations (as reported by manufacturers). This information provides individuals and organizations with a better understanding of the capabilities and limitations of available equipment.

This report is a product of an NIJ-funded project but is not published by the Department of Justice.

Get your copy of the Report Here

Learn about new posts to the CSI TECH Blog - Register for Email Alerts

 

 

 

'Dementia' The Newest Threat to Tracking Cyber Intruders

By Kelly Jackson Higgins
Dark Reading 

Forensics increasingly encompasses the analysis of potentially valuable clues and intelligence in the physical memory of an infected machine. But like anything in infosec, it's a constant cat-and-mouse game, with attackers finding new ways to hide their tracks in memory from incident response handlers trying to get to the bottom of a breach.

A researcher has developed a new tool called Dementia that cheats forensics tools that inspect attacker’s footprints in a Windows computer's memory. Dementia basically renders a phony image of the infected machine's memory as a way to hide evidence of an attacker's movements. The tool removes "specific artifacts from the memory or the image being created. While the image itself is correct -- it can be analyzed -- specific artifacts are not present, which can hide traces of attacker's activities," says Luka Milkovic, who developed the tool. Milkovic, who is a information security consultant with Croatia-based Infigo, recently demonstrated the tool at the CCC conference in Hamburg, Germany.

Dementia demonstrates how an attacker who has wrested control of a system can muck with the forensics investigation process by fooling memory-acquisition tools. It can hide artifacts such as processes and threads from several popular tools: Moonsols Win32dd (in kernel-mode only); Mandiant Memoryze; Mantech MDD; FTK Imager; and Winpmem.

Memory analysis has become a vital process for triaging machines after an attack. Security experts say it's more efficient than just slogging through hundreds of gigabytes of hard drive space, for example, and to instead drill down on a few gigs of RAM where the attacker is executing code.

"Disk forensics has been prevalent for more than a decade, and there are lots of tools and methodologies for extracting valuable information or forensic evidence from a target computer or device," Milkovic says, such as files, folders, file and folder metadata, system logs, and registry entries.

"Incident handlers realized that by acquiring the memory of the examined machine, they might create less 'side effects' on the machine, while obtaining a cleaner and more trusted snapshot of the state of the machine," he says. "In the last couple of years, a significant rise in the number of tools for acquiring and analyzing memory can be seen, and memory forensics are now considered a vital part of the incident-handling workflow."

But anti-forensics tools and techniques are nothing new. Attackers already can block memory acquisition altogether or "break" memory analysis itself so that an investigator can't study the memory image. Dementia is basically an evolution of previous breakthroughs in cheating memory forensics, Milkovic says. "Dementia can be considered as a beginning of the memory anti-forensic framework aimed at hiding arbitrary artifacts from the memory dump," he says.

It doesn't stop investigators from memory acquisition nor does it touch artifices in the live system. Instead, it modifies artifacts in the memory dump that the memory acquisition tool creates. Milkovic points to other anti-forensics techniques, such as Haruyama and Suzuki's work on breaking memory analysis and Sparks/Butler's ShadowWalker.

"Compared to these techniques, Dementia is a bit more noisy -- no advanced self-hiding capabilities implemented so a forensic expert can easily detect Dementia's presence -- but [it] can hide arbitrary artifact, has little performance impact, and does not break the analysis," he says. Dementia has two modules, user mode and kernel mode.

So what can incident handlers do when faced with anti-forensics methods by attackers? Employ another method of acquiring memory from the live and infected machine, for example, such as Firewire, or enlist an integrated crash-dump technique, Milkovic suggests. While that causes a reboot, it's tougher for the attacker to modify the artifacts.

The bottom line: Live forensics can't always be trusted because it relies on an infected machine that the investigator doesn't have complete control over. "I think they can be of extreme forensic value, but I just wanted to demonstrate that they cannot be trusted at all times," he says.

Milkovic plans to release the free Dementia tool this month.