Forensic search


Forensic Search is an emerging field of computer forensics. Forensic Search focuses on user created data such as email files, cell phone records, office documents, PDFs and other files that are easily interpreted by a person.
Forensic Search differs from computer forensic analysis in that it does not seek to review or analyze the lower level system files such as the registry, link files or disk level issues more commonly associated with traditional computer forensic analysis.

Why Forensic Search

Forensic Search has emerged due to a number of factors including:
The objective of Forensic Search software is to allow a person with only a general knowledge of computers, but skilled in document review or investigation techniques, to undertake and search user created Electronically Stored Information. Data that is typically considered to be user created ESI is made up of emails, documents, pictures and other file types created by a user, as opposed to data created by the computer's operating system. The objective of reviewing the user created data is to find information that may be used to base decisions on as part of an investigation.

Advantages of Forensic Search Software

Forensic Search software differs from using the native applications or desktop search software to search the data in that no changes are made to the data during processing or searching that may impact the results or skew the findings. Forensic Search software will also allow access to the base metadata of items not available via the native application. A good example of this would be the metadata in MS Word documents. A number of Forensic Search software products will be able to perform data recovery on a range of email file types.
Some examples of how using the native application or non-forensic application can affect the data:
Forensic Search software has been likened to eDiscovery review software, however this is not strictly the case. eDiscovery review software, while dealing with many of the same type of computer records and search options, offer extra functionality to that of Forensic Search software. Features such as redaction and legal hold are standard in eDiscovery review software. It is also the case that Forensic Search software does not meet with the higher end tasks outlined in the widely accepted Electronic Discovery Reference Model. Tasks such as Identification, Collection, Preservation or Presentation are generally not covered by Forensic Search software.
However, true eDiscovery review is generally the domain of qualified legal practitioners or companies.
The use of the term eDiscovery has become a catchall in some circles for the processing and searching of Electronically Stored Information. However, this is not a true representation of the term of eDiscovery. For a more detailed understanding of eDiscovery, the Electronic Discovery Reference Model is a .
It could be said that Forensic Search is more closely related to Early Case Assessment than eDiscovery as ECA does not require the rigor of a full eDiscovery review.

Evidence Values of User Created Data Versus Other Types of Data

When presenting data as part of a report that may be used to form a decision or as evidence, it is important that the data be correctly represented so the reader can understand it.
In the case of generating reports on system created data such as registry files, link files and other system created data this can be a costly exercise. It can also be the case that there is no straightforward answer or explanation.
An example of this would be attempting to explain to a lay person the method and techniques of decoding the in the Windows System Registry. The UserAssist key can hold a great deal of information about the actions of the user of the computer. However to explain this key, the reviewer has to be able to identify the key and correctly interpret the key setting. The keys are often encoded by ROT 13.
Once these keys are decoded to human readable formats, the reviewer then has to show how a setting relates to the case. It is often time-consuming to review hundreds, even thousands, of settings that at times only deliver very circumstantial and sometimes contentious findings.
When reviewing user created data such as e-mail or contracts, reporting and understanding the findings is often much more straight forward. The semi skilled user will usually have a good grasp of how email works as they use it in their day-to-day work. A legal person will understand a contract and does not need specialist forensic knowledge to do so. This can lead to much lower costs of review and less contentious or circumstantial findings.

High-Level Functionality of Forensic Search Software

The features of Forensic Search software are focused on allowing the user to search and view a range of data and users’ files at one time.
Specific features of Forensic Search software are:
There are many newer and emerging fields of computer forensics such as Cloud forensics, Mobile Phone forensics, Network forensics, Memory Analysis, Browser forensics, forensic triage and Internet forensics. In the not so distant past a computer forensic expert's most common role was to attend a person's house, place of work or data center to forensically all computers or devices that may be involved in a case. This was categorized as the collection phase.
Once collection phase was complete these images were reviewed and the ESI that was relevant was supplied to the interested parties. This required the computer forensic investigator to have a good deal of experience and training in:
This process was time-consuming and costly. The computer forensic expert's primary role is to investigate the computer evidence. They may not have been as familiar with the entire case or objectives as that of the case agent, detective, forensic accountant or crime analyst. This often led to non-perfect or time-consuming identification of the correct evidence items between the differing parties. What would immediately flag the interest of a detective with a deep knowledge of the case and parties involved may go unnoticed by a computer forensic expert. An example would be an email from a suspect in another case to a suspect in this case, or contact / phone calls to a witness from a suspect.
To compound the issue, there has been a massive increase in the size of the data that the computer forensic expert needs to collect. It is now often the case that the computer hard drive is not able to be imaged, for example if the computer that contains the evidence is too big, or the system cannot be shut down to take an image as it is a mission critical server such as an email server or company file server. The rise of Cloud computing has also added challenges to the collection of evidence. The data that requires collection and review may reside in the Cloud. In this case there is no computer available to image. The forensic expert then needs to collect the information using forensic software designed to work with certain Cloud providers.
In short the collection of evidence has changed significantly in the past few years. Recognizing these challenges, the concept of Hybrid Forensics has been discussed and the creation of tools that adopt a different approach to collecting data. The concept of Hybrid Forensics is the selective collection of data from 'live' systems in such a way that is may be considered as being reliable evidence in court.

Barriers to the Adoption of Forensic Search in Law Enforcement

Law enforcement organizations like many other organizations are divided into skill specific units. In the computer forensic / cybercrime area these units take responsibility for all aspects of the ESI. As discussed in "Why Forensic Search" point 5 these units are usually time poor and under resourced.
Albeit that time and resources are low the main knowledge in the unit comes from officers or consultants with 7+ years of experience. These officers have become familiar over time with the methodology of using a Forensic Analysis software package as this is all that was on offer when they started in the field. Hence when new officers or resources become available it is forensic analysis software that is prioritized over newer more specific software and newer forensic field types.

Conclusion

Forensic Search software has become popular as a method of reducing the time and cost of search and analysis of larger data sets by focusing on the user data that most often yields evidence or results.
E-mail is such seductive, powerful evidence. It's personal, plentiful and candid. For most adults, e-mail is their primary means of written communication. When lawyers think "e-discovery," it's the e-mail they crave. No surprise, then, that e-mail traffic is the most sought-after and fought-over ESI.
A new generation of tools is being developed in order to address the challenges being faced by digital forensic and ediscovery practitioners.