US-LATT Version 1.60 Evaluation Report
Total Page:16
File Type:pdf, Size:1020Kb
US-LATT Version 1.60 E V A L U A T I O N R E P O R T June 2012 NIJ Electronic Crime Technology Center of Excellence 550 Marshall St., Suite B Phillipsburg, NJ 08865 www.ECTCoE.org NIJ ECTCOE TESTING AND EVALUATION PROJECT STAFF Robert J. O’Leary, CFCE; DFCP Donald Stewart, CFCE; ACE Victor Fay-Wolfe, Ph.D. Russell Yawn, CFCE Randy Becker, CFCE Kristen McCooey, CCE; ACE Chester Hosmer Jacob Fonseca Laurie Ann O’Leary Mark Davis, Ph.D. Michael Terminelli, ACE Contents n i i i Table of Contents Introduction ................................................................................................................................................................1 Overview .....................................................................................................................................................................3 Product Information .............................................................................................................................................3 System Requirements ..........................................................................................................................................4 Target Systems .............................................................................................................................................4 Target System Requirements and Suggestions ............................................................................................4 US-LATT Confguration Application ....................................................................................................................4 Test Bed Confguration .............................................................................................................................................5 Computer Platforms .............................................................................................................................................5 The US-LATT Thumb Drive ..................................................................................................................................6 Evaluation and Testing of US-LATT .........................................................................................................................7 Test: Shop-Built Computer ...................................................................................................................................7 Results ..........................................................................................................................................................7 Test: Dell Laptop ................................................................................................................................................13 Results ........................................................................................................................................................13 Test: Samsung Laptop .......................................................................................................................................14 Results ........................................................................................................................................................14 Conclusion ...............................................................................................................................................................15 US-LATT Version 1.60 Introduction n 1 Introduction he National Institute of Justice (NIJ) Electronic process. After grants are awarded, the grantee and Crime Technology Center of Excellence the NIJ program manager then work collaboratively (ECTCoE) has been assigned the responsibil- to develop the solutions. T ity of conducting electronic crime and digital evidence n Phase IV: Demonstrate, test, evaluate and adopt tool, technology and training testing and evaluations potential solutions into practice. A potential solu- in support of the NIJ Research, Development, Testing tion is tested to determine how well it addresses and Evaluation (RDT&E) process. the intended functional requirement. NIJ then works The National Institute of Justice RDT&E process helps with frst-adopting agencies to facilitate the intro- ensure that NIJ’s research portfolios are aligned to duction of the solution into practice. After adoption, best address the technology needs of the criminal jus- the solution’s impact on practice is evaluated. Dur- tice community. The rigorous process has fve phases: ing the testing and evaluation process, performance standards and guides are developed (as appropri- n Phase I: Determine technology needs princi- ate) to ensure safety and effectiveness; not all new pally in partnership with the Law Enforcement solutions will require the publication of new stan- and Corrections Technology Advisory Council dards or guides. (LECTAC) and the appropiate Technology Work- ing Group (TWG). NIJ identifes criminal justice n Phase V: Build capacity and conduct outreach to practitioners’ functional requirements for new tools ensure that the new tool or technology benefts and technologies. (For more information on LECTAC practitioners. NIJ publishes guides and standards and the TWGs, visit http://www.justnet.org.) and provides technology assistance to second adopters.1 n Phase II: Develop technology program plans to address those needs. NIJ creates a multiyear The High Priority Criminal Justice Technology Needs research program to address the needs identifed are organized into fve functional areas: in Phase I. One of the frst steps is to determine n Protecting the Public. whether products that meet those needs currently exist or whether they must be developed. If a solu- n Ensuring Offcer Safety. tion is already available, Phases II and III are not n necessary, and NIJ moves directly to demonstra- Confrming the Guilty and Protecting the Innocent. tion, testing and evaluation in Phase IV. If solutions n Improving the Effciency of Justice. do not currently exist, they are solicited through annual, competitively awarded science and technol- n Enabling Informed Decision-Making. ogy solicitations and TWG members help review the The NIJ ECTCoE tool, technology and training evalu- applications. ation and testing reports support the NIJ RDT&E pro- n Phase III: Develop solutions. Appropriate solici- cess, which addresses high priority needs for criminal tations are developed and grantees are selected justice technology. through an open, competitive, peer-reviewed 1 National Institute of Justice High-Priority Criminal Justice Technology Needs, March 2009 NCJ 225375. US-LATT Version 1.60 Overview n 3 Overview uring the past several years, computer forensic departments only have a limited number of expe- examiners have discussed the potential loss rienced investigators with knowledge of particular Dof evidence when seizing a computer that is systems, having experts to send out in the feld powered on and the power cord is pulled at the time of to investigate individual systems is impractical. seizure. Simply pulling the plug on a running computer US-LATT enables potentially less experienced feld causes the loss of data in Random Access Memory investigators to quickly collect a variety of critical in- (RAM) and other information that might be of eviden- formation about the suspect’s computer, eliminating tiary value, such as the programs that were running at the need for an expert to travel to a target site. In the time of seizure, the windows that were minimized, addition, US-LATT provides the ability to investigate online chat conversations, connections to remote stor- systems while they are running, eliminating the need age or computers, and system data. to take critical systems offine during initial triage. Wetstone Technologies, Inc. has created a forensic n How is US-LATT Used? tool called USB Live Acquisition and Triage Tool By inserting a USB device into the suspect system, (US-LATT) to capture the volatile data listed above data can be gathered from a live machine and ana- and more. The development of US-LATT was funded lyzed later in the laboratory. US-LATT collects data by NIJ. from a target machine without the need of any spe- cialized software installation. A customized US-LATT Product Information can be quickly created and deployed to collect data pertinent to an investigation. The following excerpts from the US-LATT documenta- tion describe the tool, the functions it performs and The documentation also says US-LATT collects the how the tool can be used: following information from a running computer: n What is US-LATT? n Running Process List and Information. US-LATT is a system for live investigation and triage n Installed Services and Drivers. of potentially compromised or evidence-containing n Physical Memory Dump. computers and related devices. The product con- sists of both a data acquisition hardware com- n Installed Application List. ponent and a software-analysis component. The hardware component is a specially confgured USB n Critical Registry Data. drive containing a set of confguration fles and n Hardware Confguration Information. data collection components. The analysis functions allow for the importing of collected information and n Active Encrypted File Systems. subsequent analysis. n Event Logs. n Why use US-LATT? n Desktop Screenshot. Responding to the misuse of systems can be a n Individual Window Screenshot. tremendous task. Also, as most investigative US-LATT Version 1.60 4 n Overview n Live Network Information. Target System Requirements and Suggestions n System Data. Although