Friday, January 25, 2008

How do forensic investigators seize and analyze a computer without turning it off?

The nightmare scenario for today's modern digital forensic investigator is the seizure of a computer with strong incriminating evidence contained on its hard drive. After seizure, but prior to investigation of the drive, the computer is turned off and removed to another location. The nightmare begins when the forensic investigator realizes that the computer was password protected and encrypted; and the perp won't provide the password (or the perp is nowhere to be found!).

Think it can't happen? It just did. Read this from a recent newspaper account:

"FEDS WANT PASSWORD TO UNLOCK COMPUTER FILES".

WASHINGTON -- The federal government is asking a US District Court in Vermont to order a man to type a password that would unlock files on his computer, despite his claim that doing so would constitute self-incrimination.

The case, believed to be the first of its kind to reach this level, raises a uniquely digital-age question about how to balance privacy and civil liberties against the government's responsibility to protect the public.

The case, which involves suspected possession of child pornography, comes as more Americans turn to encryption to protect the privacy and security of files on their personal computers and thumb drives.

FBI and Justice Department officials, meanwhile, have said that encryption is allowing terrorists and criminals to communicate their plots covertly.

The original article may be found on the Washinton Post's website, in it's entirety, here.

The use of WiebeTech's 'HOTPLUG' device allows forensic criminal investigators (along with our companion product, 'Mouse Jiggler') to stabilize a computer, prevent it from going to sleep, examine it, and if necessary, relocate it to a secure location without ever powering the computer down. This is real technology, it works, and it's available now.

Go ahead and look at the links. You'll see technical information on how to use Hotplug and Mouse Jiggler, along with a couple of nifty Youtube videos that demonstrate Hotplug in action.

No comments: