Forensic Triage in a Multi-TB Era Ady Cassidy, Nuix

Transcription

1 Forensic Triage in a Multi-TB Era Ady Cassidy, Nuix

2 Ady Cassidy Systems Consultant Nuix Ady is a computer forensic investigator and ediscovery consultant with more than 10 years experience as a Computer Forensic Analyst first with the Suffolk Police High Tech Crime Unit and then as a Managing Consultant with 7Safe, where he was responsible for managing a London based ediscovery team deploying global end-to-end forensic and ediscovery services.

3 Agenda Introduction Data Growth Outstripping Investigator s Ability to Handle it Current Approach to Electronic Investigation Key Challenges for Investigators Traditional Methods Are Not Sustainable A More Efficient Alternative to Sequential Device Investigation Forensic Triage: A Targeted Approach Nuix Investigator Capabilities Why Nuix? Live Demo Q&A

4 Big Data Growing volumes of data and an increasing number of digital storage devices have made the traditional methods for electronic investigation unsustainable. For example, when dealing with an individual s home, investigators and law enforcement officers must deal with large numbers of devices, including multiple computers, mobile devices and a variety of digital storage media. Investigations that involve data stored in corporate systems are even more challenging, with a larger number of devices and high volumes of data stored in a variety of difficult-to-access formats. In light of these challenges, the traditional methods of analyzing each data repository individually using forensic tools is immensely time consuming. Further, it relies on human memory and brain power to extract intelligence and find links between disparate data sources. As a rule of thumb, the number of devices containing data involved in a typical investigation doubles each year, and the volume of data grows even faster.

5 Data growth outstripping investigators ability to handle it The propensity for evidence to be captured electronically has stretched the forensic capability of most law enforcement agencies worldwide to capacity Australia New Zealand Policing Advisory Agency (ANZPAA) Officers at a crime scene should seize devices including PC or laptop main units, external hard drives, dongles, modems, wireless network cards, routers, digital cameras, floppy disks, backup tapes, Jaz/Zip cartridges, CD-ROMs, DVD-ROMs, PCMCIA cards, memory sticks, memory cards and all USB or FireWire-connected services UK Association of Chief Police Officers, Good Practice Guide for Computer- Based Electronic Device In 2009, companies in the United States with more than 1,000 employees stored an average of 200 terabytes of data or up to 200 gigabytes per user. Today, the average is closer to one terabyte per employee. McKinsey Global Institute

6 Current Approach To Electronic Investigation When investigating electronic evidence, most law enforcement agencies use traditional forensic tools and methodologies. They use digital forensics applications to examine each data repository they receive such as hard disks, mobile devices and flash memory sticks. For each device, they typically: plug the device into a write blocker acquire a forensic image of the entire device make a copy of the forensic image analyze the data stored on the forensic image copy write a report on the results of this analysis. An investigator would then repeat this process for any other devices related to this case. Having completed this process for all devices, the investigator would then use human brainpower to find connections and correlations between the data sources.

7 Limitations Of This Approach This approach has a number of limitations, particularly in light of the growing number of devices and volume of data investigators must examine. Forensic tools: can only effectively analyze one repository at a time although they are unmatched in their ability to do so in great depth cannot thoroughly analyze complex information stores such as Lotus Notes, Microsoft Exchange, Microsoft SharePoint and archives don t automatically identify and organize important intelligence such as names, addresses, phone numbers and credit card numbers Investigators have to know what they are looking for! Human investigators, however brilliant, can t hope to consistently and accurately cross-reference and find correlations across millions of data points. It is easy to miss connections, particularly without an automated way to identify intelligence items.

8 Key Challenges The scale of data involved in many investigations overwhelms traditional forensic approaches. It is prohibitively time consuming and resource intensive to investigate multiple-terabyte databases or file archives using traditional methods. The complexity of data is also becoming an issue, especially in investigations that involve data from large organizations. This data is often stored across large numbers of siloed systems in multiple locations. Many of the formats organizations use to store unstructured data are difficult to search and compare consistently. These formats include file and archives, Lotus Notes databases, Microsoft Exchange databases, other Microsoft container formats, and Microsoft SharePoint document management systems Data is often buried multiple levels deep within data repositories, which certain forensic tools and processes may not recognize and simply skip over.

9 Nuix Investigations Today's Challenges As well as increasing in volume, digital evidence is becoming more complex. Evidence can be stored in formats including documents, spreadsheets, messages, archives and mobile device logs. The rising use of cloud storage and services adds another layer of complexity, especially because cloud providers frequently move data between one jurisdiction and other if only for reasons of efficiency. Finding the electronic smoking gun often requires searching and cross-referencing across many very large data sources. The volume and complexity of data formats as well as the difficulty of maintaining case data for years or decades after an investigation, all illustrate the great challenges for investigators. Traditional investigation methods can t cope.

10 Forensic triage: a targeted approach DEFINITION: Prioritisation of evidence/data within a case Nuix Evidence Pre Filter allows an investigator to target specific areas of investigation by isolating relevant system files that are recognised for forensic value and to analyze those areas with immediate results. BENEFIT: Investigators can view data based on it s relevance to the case which results in an efficient use of their time and expedited response for the requestor.

11 Nuix Investigations Adding efficiency and intelligence to electronic investigation How Nuix s advanced tools can help investigators examine large numbers of devices, vast volumes of data and complex data sets, saving time and automatically extracting and cross-referencing intelligence across the entire investigation.

12 Benefits: Investigating across all data sources simultaneously, rather than one at a time, is a much more efficient and sophisticated method to extract points to prove or intelligence across large volumes of data. This provides investigators with a single pane of glass view of their entire data set. For investigators, the benefits of using this approach include: Cross-referencing Intelligence across multiple data sources Automatically extract intelligence and identify potentially important entities such as names, addresses and credit card numbers Highlight connections across multiple data sources that may not be immediately obvious Access data stored in complex corporate repositories and cloud-based services It saves human brain-power and person-hours.

13 Nuix Investigator Capabilities Nuix is a worldwide provider of information management technologies including ediscovery, electronic investigation and information governance software Nuix has developed the world s fastest and most advanced unstructured data management platform Nuix technology is purpose-built to normalize unstructured information, enabling organizations to extract actionable intelligence from unstructured data, regardless of scale, format, or container.

14 Nuix Investigator Capabilities Designed for big data Investigate multiple sources at once As well as physical devices such as hard drives, smartphones and memory cards, Nuix can extra data from cloud services such as Hotmail and Gmail accounts, and corporate repositories such as Lotus notes and Microsoft Exchange systems Extract and correlate intelligence Automatically highlight and extract intelligence items such as names, phone numbers, addresses and credit card numbers. Nuix automatically correlates these data points to show how people or numbers are connected across multiple data sources and investigations Quickly understand the case with forensic triage Nuix s Evidence Pre-Filter can quickly examine tens or hundreds of terabytes within days, enabling investigators to triage and find the most critical information first, even among masses of data

15 Nuix Investigator Capabilities Used by leading global investigators Nuix electronic investigation software solutions are used by the world s leading advisory firms, litigation support providers, law firms, enterprises, government departments, law enforcement agencies, and all of the world s major corporate regulatory bodies. Powerful and interactive visual analytics Nuix s interactive data visualization and workflow framework enables investigators to visually interrogate case information using a variety of dynamically generated graphics such as time based frequency, culling, pivot charts, search hits, and location reports based on geospatial information stored in metadata Precise skin tone analysis to find inappropriate images Nuix extracts all images from the data set, even those that are embedded many levels deep or have been modified to hide their identity. Investigators can then use Nuix s skin tone algorithm to flag potentially inappropriate pictures. Rapidly and defensibly collects data from anywhere Nuix s easy-to-use and forensically sound collection tools enable rapid collection of data, wherever it resides. It can automatically collect information from laptops, desktops, enterprise file shares and common computer forensic file formats. It can even extract evidence from online or cloud services such as webmail and hosted Microsoft SharePoint.

16 Nuix electronic investigation software can: process more than 2.5 terabytes of data per day on a single high-end server interrogate all metadata, text and binary structure of documents to forensically identify relevant information keep the chain of custody of each document intact extract and make searchable files embedded up to 100 levels deep read all major formats and file structures work with all languages and character sets automatically organize, highlight and cross-reference intelligence across multiple data sources and investigations provide a comprehensive single window into your entire data set

17 Lets Take a look!

18 How many items have Chinese writing scripts, show networking maps and reports Of the above how many s contain Chinese content How many Resume/CV are there in a MS Doc format (cv-pa.doc) How many Items refer to the company World bank How many images are attachments We have been asked to show how many items have the word bond. We need to find items relating to James Bond 007 and isolate them from our results. How many images have been graded as high skin toned images How many items have been communicated from yahoo.com Who Authored doc

19 nuix.com/investigation