Here's an interesting post on taking screenshots on Android Devices. This could come in handy for cell phone forensic examiners.
Enjoy.
Thursday, January 21, 2010
Wednesday, January 20, 2010
Clearing a crop
A reader writes in to ask about an cropped image. He was having trouble finding out how to restore an image that he'd cropped in ACR. Aside from right-clicking on the image and choosing Develop Settings>Clear Settings - which clears everything ... the reader just wanted to clear the crop.
Click and hold the Crop tool and you'll find a hidden menu. Remember, whenever you see the downward pointing triangle, that's Photoshop's way of saying that there's a menu hidden under the button. At the bottom of the Crop tool's hidden menu, you'll find Clear Crop.
Clearing it using the Crop tool's menu preserves any adjustments that you've made - unlike Clear Settings.
Tuesday, January 19, 2010
Field kit tip
LA is under a storm warning. The weathermen are all in a tizzy ... they've actually got something to report. So in the spirit of the times, here's a tip to help keep your equipment field kit dry.
Take a handful of plain old rice and sew it into a cloth packet. The rice acts as a desiccant and works to rid your kit of moisture. Best of all, it shouldn't cost much at all.
I've even heard of folks using this tip as a cure for dropping their cell phone in water. They've made a few specially shaped packets and filled them with rice. They then placed them in a bowl with the phone. In a few days, they were able to get enough of the moisture out of the phone to power it on safely.
Monday, January 18, 2010
Digital Forensics Links and Resources
In response to a reader's question about internet resources, here's some of my link lists:
Digital Forensics Guidelines
Integrated Publishing Web page regarding the issue of chain of custody: http://www.tpub.com/legalman/80.htm
Online version of Electronic Crime Scene Investigation – A Guide for First Responders: http://www.ncjrs.org/pdffiles1/nij/187736.pdf
Online version of Forensics Guide to Incident Response for Technical Staff: http://www.cert.org/archive/pdf/FRGCF_v1.3.pdf
Online version of Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations: http://www.cybercrime.gov/ssmanual/index.html
Other Online Computer / Digital Forensic Resources
Alexander Geschonneck’s Security Site: Forensic – IDS – Incident Response: http://www.geschonneck.com/security/forensic.html
An Explanation of Computer Forensics, by Judd Robbins: http://www.computerforensics.net/forensics.htm
Computer Forensics Laboratory and Tools: http://www.scribd.com/doc/136793/COMPUTER-FORENSICS-LABORATORY-AND-TOOLs
Computer Forensics, Cybercrime and Steganography Resources: http://www.forensics.nl/links
Computer forensics technology articles from Mares and Company: http://www.dmares.com/maresware/articles.htm
CyberSecurity Institute – Windows Forensics Essentials: http://www.cybersecurityinstitute.biz/training/wfe.htm
Computer Forensics World: http://www.computerforensicsworld.com
Computer Professionals for Social Responsibility Computer Crime Directory: http://www.cpsr.org/prevsite/cpsr/privacy/crime/crime.html/view?searchterm=computer%20crime%20directory
Digital forensics links: http://isis.poly.edu/kulesh/forensics/list.htm
Disklabs: http://www.disklabs.com/computer-forensics-software.asp
The Electronic Evidence Information Center: http://www.e-evidence.info/
Federal Rules of Evidence (Article I): http://expertpages.com/federal/a1.htm?PHPSESSID=a2d248b5ba83a082442876135682f3af
Forensic Acquisition Utilities: http://www.gmgsystemsinc.com/fau/
Forensic Focus – Computer Forensics Papers and Articles: http://www.forensicfocus.com/computer-forensics-papers
Fundamental Computer Investigation Guide for Windows Overview: http://www.microsoft.com/technet/security/guidance/disasterrecovery/computer_investigation/default.mspx
The Forensics Science Portal: http://www.forensics.ca/index.php
Global Digital Forensics, Computer Forensic Resources: http://www.evestigate.com/COMPUTER%20FORENSIC%20RESOURCES.htm
Internet Crime Complaint Center: http://www.ic3.gov/
Law enforcement reference links: http://www.computerforensics.net/links.htm
Linux LEO: http://www.linuxleo.com/
Linux forensics: http://tech.groups.yahoo.com/group/linux_forensics/
Mobile Forensics Central: http://www.mobileforensicscentral.com/mfc/
Mobile Phone Forensics and PDA Forensics: http://www.forensics.nl/mobile-pda-forensics
National White Collar Crime Center: http://www.nw3c.org/
Technical articles on data recovery: http://www.actionfront.com/ts_articles.aspx
The Open Computer Forensics Architecture: http://ocfa.sourceforge.net/
Ultimate Guide to Mac OS Forensics: http://homepage.mac.com/macbuddy/ForensicGuide.html
Zeno’s Forensic Science Site: http://www.forensic.to/forensic.html
Enjoy.
Digital Forensics Guidelines
Integrated Publishing Web page regarding the issue of chain of custody: http://www.tpub.com/legalman/80.htm
Online version of Electronic Crime Scene Investigation – A Guide for First Responders: http://www.ncjrs.org/pdffiles1/nij/187736.pdf
Online version of Forensics Guide to Incident Response for Technical Staff: http://www.cert.org/archive/pdf/FRGCF_v1.3.pdf
Online version of Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations: http://www.cybercrime.gov/ssmanual/index.html
Other Online Computer / Digital Forensic Resources
Alexander Geschonneck’s Security Site: Forensic – IDS – Incident Response: http://www.geschonneck.com/security/forensic.html
An Explanation of Computer Forensics, by Judd Robbins: http://www.computerforensics.net/forensics.htm
Computer Forensics Laboratory and Tools: http://www.scribd.com/doc/136793/COMPUTER-FORENSICS-LABORATORY-AND-TOOLs
Computer Forensics, Cybercrime and Steganography Resources: http://www.forensics.nl/links
Computer forensics technology articles from Mares and Company: http://www.dmares.com/maresware/articles.htm
CyberSecurity Institute – Windows Forensics Essentials: http://www.cybersecurityinstitute.biz/training/wfe.htm
Computer Forensics World: http://www.computerforensicsworld.com
Computer Professionals for Social Responsibility Computer Crime Directory: http://www.cpsr.org/prevsite/cpsr/privacy/crime/crime.html/view?searchterm=computer%20crime%20directory
Digital forensics links: http://isis.poly.edu/kulesh/forensics/list.htm
Disklabs: http://www.disklabs.com/computer-forensics-software.asp
The Electronic Evidence Information Center: http://www.e-evidence.info/
Federal Rules of Evidence (Article I): http://expertpages.com/federal/a1.htm?PHPSESSID=a2d248b5ba83a082442876135682f3af
Forensic Acquisition Utilities: http://www.gmgsystemsinc.com/fau/
Forensic Focus – Computer Forensics Papers and Articles: http://www.forensicfocus.com/computer-forensics-papers
Fundamental Computer Investigation Guide for Windows Overview: http://www.microsoft.com/technet/security/guidance/disasterrecovery/computer_investigation/default.mspx
The Forensics Science Portal: http://www.forensics.ca/index.php
Global Digital Forensics, Computer Forensic Resources: http://www.evestigate.com/COMPUTER%20FORENSIC%20RESOURCES.htm
Internet Crime Complaint Center: http://www.ic3.gov/
Law enforcement reference links: http://www.computerforensics.net/links.htm
Linux LEO: http://www.linuxleo.com/
Linux forensics: http://tech.groups.yahoo.com/group/linux_forensics/
Mobile Forensics Central: http://www.mobileforensicscentral.com/mfc/
Mobile Phone Forensics and PDA Forensics: http://www.forensics.nl/mobile-pda-forensics
National White Collar Crime Center: http://www.nw3c.org/
Technical articles on data recovery: http://www.actionfront.com/ts_articles.aspx
The Open Computer Forensics Architecture: http://ocfa.sourceforge.net/
Ultimate Guide to Mac OS Forensics: http://homepage.mac.com/macbuddy/ForensicGuide.html
Zeno’s Forensic Science Site: http://www.forensic.to/forensic.html
Enjoy.
Sunday, January 17, 2010
Evidence defined
Evidence: "Testimony, writings, or material objects offered in proof of an alleged fact or proposition." - Black’s Law Dictionary
Saturday, January 16, 2010
Cybercrime Books
A friend of mine is looking at a career change and is considering digital forensics as his new career. He was looking for a few books to read ... in an effort to see if DF was in fact a good career move. I recommended the following books:
Scene of the Cybercrime
by Debra Littlejohn Shinder and Michael Cross. Here's an excerpt:
"Most organizations and experts involved in computer forensics agree on some basic standards regarding the handling of digital evidence, which can be summarized as follows:
Scene of the Cybercrime
by Debra Littlejohn Shinder and Michael Cross. Here's an excerpt:"Most organizations and experts involved in computer forensics agree on some basic standards regarding the handling of digital evidence, which can be summarized as follows:
- The original evidence should be preserved in a state as close as possible to the state it was in when found.
- If at all possible, an exact copy (image) of the original should be made to be used for examination so as not to damage the integrity of the original.
- Copies of data made for examination should be made on media that is forensically sterile—that is, there must be no preexisting data on the disk or other media; it should be completely “clean” and checked for freedom from viruses and defects.
- All evidence should be properly tagged and documented and the chain of custody preserved, and each step of the forensic examination should be documented in detail.
I also recommended The Best Damn Cybercrime and Digital Forensics Book Period
by Jack Wiles and Anthony Reyes. Here's an excerpt:
"Before we move into a discussion of digital forensic principles, it is important that we understand the difference between principles and procedures (methodologies). The Merriam-Webster online dictionary defines a principle as “a comprehensive and fundamental law, doctrine, assumption or rule” and a procedure as “a particular way of accomplishing something or of acting.” The difference between the two terms can appear to be minimal, but it is important: A principle is a fundamental truth that governs a specific endeavor; in contrast, a procedure is a method of accomplishing something."
Enjoy.
by Jack Wiles and Anthony Reyes. Here's an excerpt:"Before we move into a discussion of digital forensic principles, it is important that we understand the difference between principles and procedures (methodologies). The Merriam-Webster online dictionary defines a principle as “a comprehensive and fundamental law, doctrine, assumption or rule” and a procedure as “a particular way of accomplishing something or of acting.” The difference between the two terms can appear to be minimal, but it is important: A principle is a fundamental truth that governs a specific endeavor; in contrast, a procedure is a method of accomplishing something."
Enjoy.
Friday, January 15, 2010
CD-ROM vs CD-R
A reader writes in to ask, "what's the difference between CD-ROM and CD-R? Or ... are they the same thing?" Good question. Here's the answer:
"CD-ROM optical discs differ from CD-R and CD-RW discs in that they do not have an organic dye recording layer between the polycarbonate substrate and the light reflective layer. It’s the organic dye recording layer that allows the laser in a CD-R or CD-RW device to be heated and thus create a pit, which is in turn read as digital data." - from Computer Evidence: Collection & Preservation
by Christopher LT Brown
Keep the questions coming.
Enjoy.
"CD-ROM optical discs differ from CD-R and CD-RW discs in that they do not have an organic dye recording layer between the polycarbonate substrate and the light reflective layer. It’s the organic dye recording layer that allows the laser in a CD-R or CD-RW device to be heated and thus create a pit, which is in turn read as digital data." - from Computer Evidence: Collection & Preservation
by Christopher LT BrownKeep the questions coming.
Enjoy.
Monday, January 11, 2010
The Digital Forensic Sub-Disciplines?
In the December 2009/January 2010 issue of Forensic Magazine, John J. Barbara posits the following question to begin his article on digital forensic sub-disciplines: "Can we clearly differentiate whether an examination falls under Computer Forensics, Forensic Audio, Image Analysis, or Video Analysis?"
To begin with, I was a little suspicious of the article - given the author's profession. It seemed to me that he is making a pitch here that will certainly help his business. What's his business, you ask? He runs a company that specialises in helping agencies set up and comply with the ASCLD/LAB and ISO regulations. Is there a conflict here? Perhaps - but read the article for yourself before forming any conclusions.
One of the key points of the article (for me) was hidden about midway down the page. "Although the initiative toward gaining accreditation for the discipline was being driven primarily by the federal agencies ..." Why are federal agencies driving the initiative? Are state and local agencies participating in a meaningful way? What about privateers? How are their interests represented?
The author walks the reader through a hypothetical case where a single analyst processes a piece of digital multimedia evidence. Then he proceeds to illustrate that the analyst really was performing four functions (sub-disciplines) as part of the process. The sub-text hints that there is something inherently wrong with the single analyst model.
This article, for me, represents the latest in a worrisome trend in advocacy - away from the local / private lab toward a regional / nationally controlled lab. This, while good for the author of the article's business, it is certainly not good for the citizens of this country. Here's why ...
This trend, the NAS report, the SWG's and so forth, has been moving forensic work in a certain direction. That direction is towards greater standardisation and control of the work. So far so good. But the next logical step is to say that agencies with a single analyst (like many local police agencies and privateers) should no longer be to allowed to work across sub-disciplines. I, for example, have received training and worked cases involving video, image, audio, cell phone, and small device forensics. I also image hard drives (computer forensics). Must I now choose a specialty? What does this do to the local agency, given today's economic mess? The only agencies that are currently hiring analysts in great numbers are federal. But are federal agencies going to handle the video when a car is broken into on my block? Hardly.
Information and standardisation are good when they are used as a guide toward mastery of a given subject. They are bad when they are used to drive the market towards a specific vendor's practice - even when that "vendor" is the government. I'd hate to see the state of justice in this country when hundreds or thousands of well meaning and quite capable privateers and local LE analysts are driven out of business in the face of these "mandates." The right to an vigorous defense will be in jeopardy when all forensic functions are dispensed at the federal or regional level - driven by cost controls and governed by shrinking budgets.
If "forensics" is discussion and debate ... let the best rise practices to the top - be them private, local, state, regional, or national - in an openly competitive atmosphere. When the federal government steps in and mandates these practices - thus driving out perfectly good practitioners - everyone loses. At this point, forensics, as such, is dead. There is no discussion or debate allowed. Everyone loses.
This is just one citizen's opinion. What say you?
To begin with, I was a little suspicious of the article - given the author's profession. It seemed to me that he is making a pitch here that will certainly help his business. What's his business, you ask? He runs a company that specialises in helping agencies set up and comply with the ASCLD/LAB and ISO regulations. Is there a conflict here? Perhaps - but read the article for yourself before forming any conclusions.
One of the key points of the article (for me) was hidden about midway down the page. "Although the initiative toward gaining accreditation for the discipline was being driven primarily by the federal agencies ..." Why are federal agencies driving the initiative? Are state and local agencies participating in a meaningful way? What about privateers? How are their interests represented?
The author walks the reader through a hypothetical case where a single analyst processes a piece of digital multimedia evidence. Then he proceeds to illustrate that the analyst really was performing four functions (sub-disciplines) as part of the process. The sub-text hints that there is something inherently wrong with the single analyst model.
This article, for me, represents the latest in a worrisome trend in advocacy - away from the local / private lab toward a regional / nationally controlled lab. This, while good for the author of the article's business, it is certainly not good for the citizens of this country. Here's why ...
This trend, the NAS report, the SWG's and so forth, has been moving forensic work in a certain direction. That direction is towards greater standardisation and control of the work. So far so good. But the next logical step is to say that agencies with a single analyst (like many local police agencies and privateers) should no longer be to allowed to work across sub-disciplines. I, for example, have received training and worked cases involving video, image, audio, cell phone, and small device forensics. I also image hard drives (computer forensics). Must I now choose a specialty? What does this do to the local agency, given today's economic mess? The only agencies that are currently hiring analysts in great numbers are federal. But are federal agencies going to handle the video when a car is broken into on my block? Hardly.
Information and standardisation are good when they are used as a guide toward mastery of a given subject. They are bad when they are used to drive the market towards a specific vendor's practice - even when that "vendor" is the government. I'd hate to see the state of justice in this country when hundreds or thousands of well meaning and quite capable privateers and local LE analysts are driven out of business in the face of these "mandates." The right to an vigorous defense will be in jeopardy when all forensic functions are dispensed at the federal or regional level - driven by cost controls and governed by shrinking budgets.
If "forensics" is discussion and debate ... let the best rise practices to the top - be them private, local, state, regional, or national - in an openly competitive atmosphere. When the federal government steps in and mandates these practices - thus driving out perfectly good practitioners - everyone loses. At this point, forensics, as such, is dead. There is no discussion or debate allowed. Everyone loses.
This is just one citizen's opinion. What say you?
Thursday, January 7, 2010
Check out the new Premiere Pro
The new Premiere Pro looks great. With GPU acceleration through the Mercury Playback Engine, you can do things like you've never done them before. They've also added support for native Canon 1D, 5D, 7D video as well as other DSLR video formats.
Watch the video from Digital Dave on Adobe TV for all the info.
Enjoy.
Watch the video from Digital Dave on Adobe TV for all the info.
Enjoy.
Wednesday, January 6, 2010
Flash comes to the DROID
As usual, CES is full of news of cool new toys ... as well as new features to old toys. One cool development is Flash Player 10.1 for the DROID.
Who knows ... hint, hint, .... you may see an app that allows you to serve up multimedia evidence from a secure site to your DROID, leveraging the power of the Creative Suite apps on the back end.
"Here you are, Mr./Ms. Attorney. I just sent you the link. This is the video from the robbery that we're talking about. Can we file the case now? Thanks."
Enjoy.
Who knows ... hint, hint, .... you may see an app that allows you to serve up multimedia evidence from a secure site to your DROID, leveraging the power of the Creative Suite apps on the back end.
"Here you are, Mr./Ms. Attorney. I just sent you the link. This is the video from the robbery that we're talking about. Can we file the case now? Thanks."
Enjoy.
Snagit for Mac - beta
There's a beta release out for Snagit Mac. It requires an Intel Mac running at least 10.5.8.
I'm not sure how this one will be received. iShowU already has plenty of traction - and most like the Mac's built in screen capture.
Stay tuned ... we'll see how it goes.
Enjoy.
I'm not sure how this one will be received. iShowU already has plenty of traction - and most like the Mac's built in screen capture.
Stay tuned ... we'll see how it goes.
Enjoy.
Tuesday, January 5, 2010
Updates are out
There are updates for Suitcase Fusion 2 (Mac) and Toast Titanium 10.
These are both maintenance fixes. As usual, back stuff up before updating software. You never know how your system will respond.
Enjoy.
These are both maintenance fixes. As usual, back stuff up before updating software. You never know how your system will respond.
Enjoy.
Monday, January 4, 2010
Photoshop for LE classes scheduled
Photoshop for Law Enforcement at LA CLEAR - 8 hours (hands on) (skill level - basic/intermediate)
The next scheduled class is set for Thursday, February 4th, 2010 at LA CLEAR in Commerce, Ca.
This training is for LE and military personnel. ID will be verified.
If you are working with images in an LE setting, this class is for you.
Click on the link for more details. Click here to see all the offerings at LA HIDTA Training.
This class has been approved for 8 hours of credit towards your LEVA certification or continuing education requirement.
The next scheduled class is set for Thursday, February 4th, 2010 at LA CLEAR in Commerce, Ca.
This training is for LE and military personnel. ID will be verified.
If you are working with images in an LE setting, this class is for you.
Click on the link for more details. Click here to see all the offerings at LA HIDTA Training.
This class has been approved for 8 hours of credit towards your LEVA certification or continuing education requirement.
Sunday, January 3, 2010
32 Bit?
32 Bit? A reader wandered into this version of the Color Picker by accident. This is what the Color Picker looks like for 32 bit images. You now get the 32 bit values (top) (from 0-1 = zero is the absence of colour and 1 is that colour completely saturated) as well as the ability to make the colour in the picker directly relate to the document. I also like the fact that I can bump up / fade the intensity of colour by stops. So much more control ...
It never hurts to explore the program and try new things. Who knows, soon enough the hardware manufacturers will catch up and 32 bit will be all the rage.
Enjoy.
Saturday, January 2, 2010
ACR - what's the Clarity slider for?
A reader writes in to ask about the Clarity slider. "Hey Jim. What's the Clarity slider for?"
The Clarity slider is an easy to use but powerful way to add mid-tone contrast to an image. It's also great for carving details out of dull/flat mid-tone areas without resorting to over-sharpening.
Enjoy.
The Clarity slider is an easy to use but powerful way to add mid-tone contrast to an image. It's also great for carving details out of dull/flat mid-tone areas without resorting to over-sharpening.
Enjoy.
Friday, January 1, 2010
Tuesday, December 29, 2009
Moot Court / Mock Trial Preparation
“I used to say that, as Solicitor General, I made three arguments in every case. First came the one I had planned — as I thought, logical, coherent, complete. Second was the one I actually presented — interrupted, incoherent, disjointed, disappointing. The third was the utterly devastating argument that I thought of after going to bed that night.” - Justice Robert T. Jackson
Here's a link to an interesting article on oral arguments from the Texas Bar.
Enjoy.
Here's a link to an interesting article on oral arguments from the Texas Bar.
Enjoy.
Monday, December 28, 2009
TMZ and an old photo create a stir
TMZ ran with this story this morning on a "JFK" photo that could have changed history. It got updated later in the afternoon.
It's an interesting study in how the media deals with "experts" and how the public reacts ... it was disturbing reading the over 20 pages of comments. The funny thing ... with what we know about JFK's lifestyle, it would be easy to assume that the figure in the photo is JFK.
The bottom line, for those that just can't see themselves going to TMZ ... the photo wasn't "Photoshopped." The print is probably a good but old copy from the original. So far so good. But, it's not JFK. Some comments that I have received have accused Prof. Sedlik of confirmation bias. I wouldn't go that far. There's no way of knowing what's lying on the edit room floor. I've had my own problems with being taken out of context and having words twisted and edited to fit a preconceived story-line (not with TMZ but elsewhere).
In the end, Playboy confirmed that the photo is authentic, that it ran in the magazine (in colour) in 1967, and that the people in the scene are models.
Enjoy.
It's an interesting study in how the media deals with "experts" and how the public reacts ... it was disturbing reading the over 20 pages of comments. The funny thing ... with what we know about JFK's lifestyle, it would be easy to assume that the figure in the photo is JFK.
The bottom line, for those that just can't see themselves going to TMZ ... the photo wasn't "Photoshopped." The print is probably a good but old copy from the original. So far so good. But, it's not JFK. Some comments that I have received have accused Prof. Sedlik of confirmation bias. I wouldn't go that far. There's no way of knowing what's lying on the edit room floor. I've had my own problems with being taken out of context and having words twisted and edited to fit a preconceived story-line (not with TMZ but elsewhere).
In the end, Playboy confirmed that the photo is authentic, that it ran in the magazine (in colour) in 1967, and that the people in the scene are models.
Enjoy.
Sunday, December 27, 2009
Create PDF files from your clipboard
Here's a cool Acrobat Pro tip ... create PDF files directly from your clipboard.
Simply press the Print Screen button on your PC keyboard. Then, in Acrobat Pro, pull down the Create menu and choose PDF from Clipboard Image. How cool is that?!
Enjoy.
Simply press the Print Screen button on your PC keyboard. Then, in Acrobat Pro, pull down the Create menu and choose PDF from Clipboard Image. How cool is that?!
Enjoy.
Saturday, December 26, 2009
Friday, December 25, 2009
Thursday, December 24, 2009
SWGDE weighs in on Research Council Reports
From Forensic Magazine:
"Since the February 18, 2009, release of the National Research Council Report, “Strengthening Forensic Science in the United States: A Path Forward,” we’ve published coverage and opinions about the report and its recommendations in the magazine and weekly e-newsletter. The 13 recommendations outlined a path, but it seems the work of clearing the brush has only begun. We will continue to follow this topic and, hopefully, the actions that will take place over the next months and years.
Recently, the Scientific Working Group on Digital Evidence (SWGDE) posted a position paper on the report that states the “report is a call to action for SWGDE to strengthen the digital evidence discipline.”
While SWGDE endorses many of the recommendations, some endorsements are with reservations and qualifications. The SWGDE response to Recommendation 7: Mandatory accreditation and certification supports accreditation for digital evidence laboratories but notes that “mandatory accreditation using the current process is not feasible for all laboratories…” In lieu of a mandatory accreditation, they recommend “that all digital evidence laboratories have a written quality management system in place to provide confidence and assurance in the quality of that laboratory’s work.”
Read the rest by clicking here.
Enjoy.
"Since the February 18, 2009, release of the National Research Council Report, “Strengthening Forensic Science in the United States: A Path Forward,” we’ve published coverage and opinions about the report and its recommendations in the magazine and weekly e-newsletter. The 13 recommendations outlined a path, but it seems the work of clearing the brush has only begun. We will continue to follow this topic and, hopefully, the actions that will take place over the next months and years.
Recently, the Scientific Working Group on Digital Evidence (SWGDE) posted a position paper on the report that states the “report is a call to action for SWGDE to strengthen the digital evidence discipline.”
While SWGDE endorses many of the recommendations, some endorsements are with reservations and qualifications. The SWGDE response to Recommendation 7: Mandatory accreditation and certification supports accreditation for digital evidence laboratories but notes that “mandatory accreditation using the current process is not feasible for all laboratories…” In lieu of a mandatory accreditation, they recommend “that all digital evidence laboratories have a written quality management system in place to provide confidence and assurance in the quality of that laboratory’s work.”
Read the rest by clicking here.
Enjoy.
Wednesday, December 23, 2009
Memory and Multiprocessing Applications
With the prices of RAM coming down, and 64bit OS systems flooding the market, folks are writing in asking about system configurations and getting the most out of their systems/applications.
Here's a couple of links to help you get the best set-up for your multiprocessing applications:
Here's a couple of links to help you get the best set-up for your multiprocessing applications:
- Memory and multiprocessing preferences (Adobe After Effects)
- Performance tip: don't starve your applications of RAM
Tuesday, December 22, 2009
Crime stats and work loads
Over at Media-Geek, I responded to a post asking about requests for cell-phone forensics. I mentioned that in just a short amount of time, requests went from zero to OMFG. Same thing goes for the retrieval of evidence from DVRs.
Here's a little insight from former mayoral candidate Walter Moore's blog. FBI and LAPD stats show that 22,624 people have been victims of violent crimes in LA so far this year. The number for victims of property crimes is an amazing 87,371 (greater than the population of the town that I grew up in). Add them up (who said that I'd never need math after high-school?) and you have 109,995 crime victims in these two categories through December 12, 2009.
If it takes an average of 2 hours to process a DVR at a crime scene, master the evidence, do the paperwork, and etc. ... how many people do you think it would take to handle 109,995 crimes? Here's a hint, a 40 hour work week adds up to a little over 2000 hours for the year. (understanding that not every crime was captured by a DVR) If it takes the same amount of time, on average, to process a cell-phone ... then things start to get a little crazy.
Just a little something to think about as you start your day.
Enjoy.
Here's a little insight from former mayoral candidate Walter Moore's blog. FBI and LAPD stats show that 22,624 people have been victims of violent crimes in LA so far this year. The number for victims of property crimes is an amazing 87,371 (greater than the population of the town that I grew up in). Add them up (who said that I'd never need math after high-school?) and you have 109,995 crime victims in these two categories through December 12, 2009.
If it takes an average of 2 hours to process a DVR at a crime scene, master the evidence, do the paperwork, and etc. ... how many people do you think it would take to handle 109,995 crimes? Here's a hint, a 40 hour work week adds up to a little over 2000 hours for the year. (understanding that not every crime was captured by a DVR) If it takes the same amount of time, on average, to process a cell-phone ... then things start to get a little crazy.
Just a little something to think about as you start your day.
Enjoy.
Monday, December 21, 2009
Body worn cameras making headlines
From the San Jose Mercury News:
San Jose police, under fire for interactions with the public that have turned violent, on Friday launched a pilot project equipping officers with head-mounted cameras to record contacts with civilians.
Officers will activate the cameras, about the size of a Bluetooth device and attached by a headband above the ear, every time they respond or make contact with a person. At the end of the officer's shift, the recording will be downloaded to a central server.
Chief Rob Davis said the devices, to be tested by 18 patrol officers, are a technological advance comparable to the advent of police cars, two-way radios and the 911 emergency system.
Read more by clicking here.
From the Globe and Mail:
Wearing video cameras will be routine for Vancouver police officers in the next few years, says the police chief in Canada's third-largest city.
Chief Constable Jim Chu says he favours the idea, suggesting it would be the ultimate means of preserving the truth in incidents that draw police attention.
“This is a new world. Ten years ago, you would never see video. Now you're going to see it all the time,” Chief Chu said in an interview.
“I'll give you the future: Officers will be wearing body cameras.”
Read more by clicking here.
Enjoy.
San Jose police, under fire for interactions with the public that have turned violent, on Friday launched a pilot project equipping officers with head-mounted cameras to record contacts with civilians.
Officers will activate the cameras, about the size of a Bluetooth device and attached by a headband above the ear, every time they respond or make contact with a person. At the end of the officer's shift, the recording will be downloaded to a central server.
Chief Rob Davis said the devices, to be tested by 18 patrol officers, are a technological advance comparable to the advent of police cars, two-way radios and the 911 emergency system.
Read more by clicking here.
From the Globe and Mail:
Wearing video cameras will be routine for Vancouver police officers in the next few years, says the police chief in Canada's third-largest city.
Chief Constable Jim Chu says he favours the idea, suggesting it would be the ultimate means of preserving the truth in incidents that draw police attention.
“This is a new world. Ten years ago, you would never see video. Now you're going to see it all the time,” Chief Chu said in an interview.
“I'll give you the future: Officers will be wearing body cameras.”
Read more by clicking here.
Enjoy.
Sunday, December 20, 2009
Experimental Validation Tool For Cell Phone Forensics Developed
From Test and Measurement.com
"Viewers of TV dramas don't focus on the technology behind how a forensics crime team tracks a terrorist or drug ring using cell phone data, but scientists at the National Institute of Standards and Technology (NIST) do. NIST researchers have developed a new technique aimed at improving the validation of a crime lab's cell phone forensics tools. Early experiments show promise for easier, faster and more rigorous assessments than with existing methods.
Cell phones reveal much about our daily communications—the who, when and what of our calls and texts. A small chip card within most phones, called an identity module, stores this and other data for a subscriber. A subscriber identity module (SIM) accommodates phonebook entries, recently dialed numbers, text messages and cellular carrier information. Forensic examiners use off-the-shelf software tools to extract the data, allowing them to "connect the dots" in a criminal case such as identifying affiliations or detecting mobile phone activity around the time of an event.
But for this information to be used as evidence in court or other formal proceedings, the software tools that forensic teams employ are normally validated to determine suitability for use. Currently, preparing test materials for assessing cell phone tools is labor intensive and may require learning new command languages to perform the process.
NIST scientists detail their proof-of-concept research in a NIST Interagency Report, Mobile Forensic Reference Materials: A Methodology and Reification (available online at http://csrc.nist.gov/publications/nistir/ir7617/nistir-7617.pdf.) They also developed an experimental application, called SIMfill, and a preliminary test dataset that follows the methodology described in the report. SIMfill can be used to automatically upload cell phone data such as phone numbers and text messages to "populate" test SIMs that can then be recovered by forensic cell phone tools. In this way, examiners can use SIMfill as one method to assess the quality of their off-the-shelf tool."
To read the rest of this article, click here.
Enjoy.
"Viewers of TV dramas don't focus on the technology behind how a forensics crime team tracks a terrorist or drug ring using cell phone data, but scientists at the National Institute of Standards and Technology (NIST) do. NIST researchers have developed a new technique aimed at improving the validation of a crime lab's cell phone forensics tools. Early experiments show promise for easier, faster and more rigorous assessments than with existing methods.
Cell phones reveal much about our daily communications—the who, when and what of our calls and texts. A small chip card within most phones, called an identity module, stores this and other data for a subscriber. A subscriber identity module (SIM) accommodates phonebook entries, recently dialed numbers, text messages and cellular carrier information. Forensic examiners use off-the-shelf software tools to extract the data, allowing them to "connect the dots" in a criminal case such as identifying affiliations or detecting mobile phone activity around the time of an event.
But for this information to be used as evidence in court or other formal proceedings, the software tools that forensic teams employ are normally validated to determine suitability for use. Currently, preparing test materials for assessing cell phone tools is labor intensive and may require learning new command languages to perform the process.
NIST scientists detail their proof-of-concept research in a NIST Interagency Report, Mobile Forensic Reference Materials: A Methodology and Reification (available online at http://csrc.nist.gov/publications/nistir/ir7617/nistir-7617.pdf.) They also developed an experimental application, called SIMfill, and a preliminary test dataset that follows the methodology described in the report. SIMfill can be used to automatically upload cell phone data such as phone numbers and text messages to "populate" test SIMs that can then be recovered by forensic cell phone tools. In this way, examiners can use SIMfill as one method to assess the quality of their off-the-shelf tool."
To read the rest of this article, click here.
Enjoy.
Saturday, December 19, 2009
Justices Revisit Rule Requiring Lab Testimony
Justices Revisit Rule Requiring Lab Testimony
From the NY Times
"Virginia Hernandez Lopez admitted to knocking back two shots of tequila with Sprite chasers on an August night in Julian, Calif., a couple of years ago. But she said she was not drunk when her Ford Explorer collided with an oncoming Toyota pickup truck later that night, killing its driver.
In May, a California state appeals court affirmed Ms. Lopez’s conviction for vehicular manslaughter. Her blood-alcohol level two hours after the accident was, according to a report presented to the jury, just over the legal limit of .08 percent.
But the appeals court reconsidered the case after a decision in June from the United States Supreme Court that prohibited prosecutors from introducing crime lab reports without testimony from the analysts who prepared them.
The appeals court reversed Ms. Lopez’s conviction, saying prosecutors had violated her constitutional right to confront witnesses against her by failing to put the analyst who prepared the blood-alcohol report on the stand.
But now, in an unusual move, the Supreme Court will hear arguments on Jan. 11 in a new case that raises questions about how lower courts may carry out its six-month-old precedent. Many state attorneys general and prosecutors are hoping the court will overrule its decision in the earlier case, Melendez-Diaz v. Massachusetts, before it can take root, saying it is a costly, disruptive and dangerous misstep.
“Already data and anecdotal evidence are demonstrating an overwhelming negative impact,” a friend-of-the-court brief submitted by 26 attorneys general last month said. The decision, they said, “is already proving unworkable.”
Rather than overturning the court’s June decision in the new case, which involves two Virginia cocaine trafficking convictions, the justices may simply clarify the ground rules for when and how analysts’ testimony must be presented."
Read the rest of the story by clicking here.
Enjoy.
From the NY Times
"Virginia Hernandez Lopez admitted to knocking back two shots of tequila with Sprite chasers on an August night in Julian, Calif., a couple of years ago. But she said she was not drunk when her Ford Explorer collided with an oncoming Toyota pickup truck later that night, killing its driver.
In May, a California state appeals court affirmed Ms. Lopez’s conviction for vehicular manslaughter. Her blood-alcohol level two hours after the accident was, according to a report presented to the jury, just over the legal limit of .08 percent.
But the appeals court reconsidered the case after a decision in June from the United States Supreme Court that prohibited prosecutors from introducing crime lab reports without testimony from the analysts who prepared them.
The appeals court reversed Ms. Lopez’s conviction, saying prosecutors had violated her constitutional right to confront witnesses against her by failing to put the analyst who prepared the blood-alcohol report on the stand.
But now, in an unusual move, the Supreme Court will hear arguments on Jan. 11 in a new case that raises questions about how lower courts may carry out its six-month-old precedent. Many state attorneys general and prosecutors are hoping the court will overrule its decision in the earlier case, Melendez-Diaz v. Massachusetts, before it can take root, saying it is a costly, disruptive and dangerous misstep.
“Already data and anecdotal evidence are demonstrating an overwhelming negative impact,” a friend-of-the-court brief submitted by 26 attorneys general last month said. The decision, they said, “is already proving unworkable.”
Rather than overturning the court’s June decision in the new case, which involves two Virginia cocaine trafficking convictions, the justices may simply clarify the ground rules for when and how analysts’ testimony must be presented."
Read the rest of the story by clicking here.
Enjoy.
Thursday, December 17, 2009
Microsoft develops image DNA technology for fighting child porn
From ZDNet: "Microsoft, through a combination of efforts from the National Center for Missing and Exploited Children (NCMEC), their own dedicated Microsoft Research section and Dartmouth College, Hanover, a new next-generation technology is being launched with the aim of tacking online child abuse imagery.
Using PhotoDNA, the system picks out images which are identical, even if they have been edited, resized, cropped and edited in other ways, and logs them. The system matches them through a technique which monochromes the image, breaks the image into smaller chunks and the intensity gradients are converted into a signature.
The signatures, even through editing, will remain the same and allow the system to find copies of the original image. Some similarities could compare QR codes to this, allowing similar cells to match other images, allowing the system to recognise similar gradients and therefore image copies across massive sets of data."
Read the rest of the story by clicking here.
Enjoy.
Using PhotoDNA, the system picks out images which are identical, even if they have been edited, resized, cropped and edited in other ways, and logs them. The system matches them through a technique which monochromes the image, breaks the image into smaller chunks and the intensity gradients are converted into a signature.
The signatures, even through editing, will remain the same and allow the system to find copies of the original image. Some similarities could compare QR codes to this, allowing similar cells to match other images, allowing the system to recognise similar gradients and therefore image copies across massive sets of data."
Read the rest of the story by clicking here.
Enjoy.
SMICT standard?
"Hey Jim, I came across this acronym (SMICT) the other day, but I can't find a reference. It deals with video. Can you help?"
Sure. How's this?
From CCTV Surveillance: Analog and Digital Video Practices and Technology, Second Edition by Herman Kruegle
"7.4.3.6.2 SMICT Standard
The super motion image compression technology (SMICT) standard has almost the same characteristics of H.264. Based on redundancy in motion, it combines digital signal processing (DSP) hardware compression, with CPU software compression. Utilizing an intelligent nonlinear super motion CODEC, SMICT intelligently analyzes the motion changes in the scene that occurred within the frame, eliminates the redundant portion of the image that need not be stored, and compresses the delta (or change) based on motion."
Sure. How's this?
From CCTV Surveillance: Analog and Digital Video Practices and Technology, Second Edition by Herman Kruegle
"7.4.3.6.2 SMICT Standard
The super motion image compression technology (SMICT) standard has almost the same characteristics of H.264. Based on redundancy in motion, it combines digital signal processing (DSP) hardware compression, with CPU software compression. Utilizing an intelligent nonlinear super motion CODEC, SMICT intelligently analyzes the motion changes in the scene that occurred within the frame, eliminates the redundant portion of the image that need not be stored, and compresses the delta (or change) based on motion."
Eliminates ... compresses ... sounds like a winner ...
Wednesday, December 16, 2009
UK announces National CCTV Oversight body
Exciting times for CCTV in the UK.
"Attached is a brief update on the announcement that has today been made by the Policing Minister regarding the establishment of a CCTV oversight body, which includes the appointment of Andrew Rennison as the interim CCTV Regulator."
I received the following in a note from the CCTV Users group:
"... Whilst personally supportive of the principal of a government body as all the devil will lie in the detail and as usual little detail is included in the briefing note, and so it will be critical for those representing the owners. managers and operators of the wide variety of CCTV systems to be involved to help frame and support the role of oversight body and interim CCTV regulator."
"Attached is a brief update on the announcement that has today been made by the Policing Minister regarding the establishment of a CCTV oversight body, which includes the appointment of Andrew Rennison as the interim CCTV Regulator."
I received the following in a note from the CCTV Users group:
"... Whilst personally supportive of the principal of a government body as all the devil will lie in the detail and as usual little detail is included in the briefing note, and so it will be critical for those representing the owners. managers and operators of the wide variety of CCTV systems to be involved to help frame and support the role of oversight body and interim CCTV regulator."
Click here to read the briefing.
According to the briefing note, "The role of the interim Regulator will be to work with the National CCTV Strategy Board on six key areas. These are to:
According to the briefing note, "The role of the interim Regulator will be to work with the National CCTV Strategy Board on six key areas. These are to:
- develop national standards for the installation and use of CCTV in public space;
- determine training requirements for users and practitioners; • engage with the public and private sector in determining the need and potential content of any regulatory framework;
- raise public awareness and understanding of how CCTV operates and the benefits to tackling crime and public protection;
- review the existing recommendations of the National CCTV Strategy and advising the Strategy Board on implementation, timelines and cost and development of an effective evidence base;
- promote public awareness of the complaints process and criteria for complaints to the relevant agencies (e.g. Information Commissioner, local authority, private organisation etc) and dealing with complaints relating to technical standards."
Let's hope they do the sensible thing .... and get the Doktor involved in a meaningful way.
Monday, December 14, 2009
The A-Z of Programming Languages: MATLAB
Here's an interesting article (one in a series on the most popular programming languages) featuring MATLAB creator Cleve Moler.
It's interesting to see how far we've come in such a short amount of time.
Sunday, December 13, 2009
Saturday, December 12, 2009
Florida Judges must "De-Friend" lawyers on Facebook
FLORIDA SUPREME COURT - Judicial Ethics Advisory Committee
Opinion Number: 2009-20
Date of Issue: November 17, 2009
ISSUES
Whether a judge may post comments and other material on the judge's page on a social networking site, if the publication of such material does not otherwise violate the Code of Judicial Conduct.
ANSWER: Yes.
Whether a judge may add lawyers who may appear before the judge as "friends" on a social networking site, and permit such lawyers to add the judge as their "friend."
ANSWER: No.
Whether a committee of responsible persons, which is conducting an election campaign on behalf of a judge's candidacy, may post material on the committee's page on a social networking site, if the publication of the material does not otherwise violate the Code of Judicial Conduct.
ANSWER: Yes.
Whether a committee of responsible persons, which is conducting an election campaign on behalf of a judge's candidacy, may establish a social networking page which has an option for persons, including lawyers who may appear before the judge, to list themselves as "fans" or supporters of the judge's candidacy, so long as the judge or committee does not control who is permitted to list himself or herself as a supporter.
ANSWER: Yes.
Opinion Number: 2009-20
Date of Issue: November 17, 2009
ISSUES
Whether a judge may post comments and other material on the judge's page on a social networking site, if the publication of such material does not otherwise violate the Code of Judicial Conduct.
ANSWER: Yes.
Whether a judge may add lawyers who may appear before the judge as "friends" on a social networking site, and permit such lawyers to add the judge as their "friend."
ANSWER: No.
Whether a committee of responsible persons, which is conducting an election campaign on behalf of a judge's candidacy, may post material on the committee's page on a social networking site, if the publication of the material does not otherwise violate the Code of Judicial Conduct.
ANSWER: Yes.
Whether a committee of responsible persons, which is conducting an election campaign on behalf of a judge's candidacy, may establish a social networking page which has an option for persons, including lawyers who may appear before the judge, to list themselves as "fans" or supporters of the judge's candidacy, so long as the judge or committee does not control who is permitted to list himself or herself as a supporter.
ANSWER: Yes.
Read the rest of this interesting ruling by clicking here.
Friday, December 11, 2009
Premiere Pro CS4 - 4.2.1 update
There's a new update for Premiere Pro CS4. It's a "hot fix" for some memory issues that came up with AVC-intra files.
Get it with automatic updates.
Thursday, December 10, 2009
Helping First Responders Investigate Electronic Crime Scenes
"Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition," a publication from the NIJ, is designed to assist state and local law enforcement and others who may be responsible for preserving an electronic crime scene and for recognizing, collecting, and safeguarding digital evidence.
This report outlines types of digital evidence, digital investigative tools, as well as crime scene procedures and evidence analysis. While not meant to be all inclusive, the report provides general guidelines for addressing situations encountered with electronic crime scenes and digital evidence.
Read the full report by clicking here.
This report outlines types of digital evidence, digital investigative tools, as well as crime scene procedures and evidence analysis. While not meant to be all inclusive, the report provides general guidelines for addressing situations encountered with electronic crime scenes and digital evidence.
Read the full report by clicking here.
Wednesday, December 9, 2009
Resources for Premiere Pro users
Here's a end-of-year review of the various documentation, training, and tech support resources Adobe makes available to users of Adobe Premiere Pro.
Subscribe to:
Posts (Atom)