• Abstract and Figures
• Public Full-text

Models in Collaborative and Distributed Digital Investigation In the World of Ubiquitous Computing and Communication Systems Michael Losavio, Deborah Keeling and Michael Lemon Abstract Ubiquitous computing and communication systems produce ubiquitous electronic evidence of use in many disciplines. For law enforcement, the use of digital evidence has expanded beyond electronic child exploitation materials into other traditional areas of criminal justice, including homicide, robbery and narcotics trafficking. This expanded utility is also available to any information community in need of historical data. But the growth in the distribution and volume of this information and its storage media create challenges for collection and the validation of reliability. Several ad hoc and distributed models for investigative process may assist both law enforcement and the curation and archival communities. We examine and discuss the data from these models and the future of distributing digital forensic expertise for broad use. Authors Michael Losavio teaches on computer engineering and criminal justice issues at the University of Louisville and has taught in Egypt and Mexico. His J.D. is from Louisiana State University. Dr. Deborah Keeling received her Ph.D. from Purdue University in sociology and is chair of the Department of Justice Administration of the University. Her research interests are in democratic policing in Europe and Asia and electronic crime. Michael Lemon is a detective for the Bowling Green (Ky) Police Department and a M.S. student in digital forensics at the University of Central Florida. 1. Introduction Ubiquitous computing permeates the world. The number of cell phones exceeds the U.S. population.1 With the proliferation of digital technology comes a commensurate growth in transactional and content- related electronic information. This creates unprecedented opportunities for the collection of electronic evidence.2 Criminologist James Allen Fox of Northeastern University attributes, in part, the 2011 decline 1 Kang, Cecilia, “Number of cellphones exceeds U.S. population: CTIA trade group,” Washington Post Tech Blog, October 11, 2011, http://www.washingtonpost.com/blogs/post-tech/post/number-of-cell-phones-exceeds-us- population-ctia-trade-group/2011/10/11/gIQARNcEcL_blog.html (accessed December 20, 2011) 2 It also presents an unprecedented means of automated surveillance of citizens, an issue of civil liberties and authoritarian oppression of greater and greater importance in violent crimes in the United States to improvements in digital investigation and electronic surveillance.3 Issues of digital investigation are not confined to criminal justice. One survey of divorce attorneys of the American Academy of Matrimonial Lawyers found that two- thirds of members used the social networking site Facebook as a primary source of digital evidence for divorce proceedings; the strong majority noted an increase in the use of such evidence over the past several years.4 And this extends far beyond criminal investigations into civil forensics, data analytics and, indeed, the ways needed to preserve and validate the memory of the world for future generations. Duranti,5 Endicott-Popovsky and others have explored the application of digital forensics to the “born-digital” world as a crucial domain for preserving truth in an electronic world. Kirshchenbaum, Ovenden and Redwine have systematically addressed the relationship of digital forensics and born-digital data for cultural heritage.6 Digital forensic systems could solve key issues facing archivists with electronic information, such as data recovery and discovery, authentication and accessioning. Yet, there are shared challenges across all of these disciplines for the effective use of digital forensics in a world of ubiquitous computing. The responses of the law enforcement community may aid all disciplines in meeting them. Law enforcement digital forensics needs have grown with the ubiquity of electronic evidence associated with all types of criminal investigations. Many investigators now look for digital evidence in any case. Either through training, conversations with other investigators or television, use of digital evidence is becoming more and more common in police work. Officers now seek digital evidence as they would surveillance videos, fingerprints and DNA. One fetal abduction/murder investigation shows the value of digital forensics to any investigation.7 The female suspect presented to the local emergency room with a newborn child. When she was examined the ER staff notice the infant had organs attached that should still be in the mother if the mother were still alive. This led to an investigation of what actually occurred. The examination of the suspect’s computer and cell phone found a scheme to acquire an infant. Evidence from the computer showed contacts with several pregnant females on social media sites and searches of the Internet for how to do a home Caesarean section delivery of a baby. She claimed to help single mothers during their pregnancy. One person seemed to have more contact with the suspect than others; this person and the suspect talked about meeting on the day of suspect’s “delivery.” The suspect’s cell phone contained the digital trail from that point. Text messages between the pregnant female and the suspect showed her planning to pick up the female and take her shopping for baby clothes. After the planned time to meet, the texting goes quiet for two hours. The suspect then texts her husband pictures of her new baby which she “delivered” in her vehicle. 3 Devlin, Barrett., “Crime Down Across Nation,” Wall Street Journal (Online) [New York, N.Y] 20 Dec 2011 4 Margaret M. DiBianca, Ethical Risks Arising from Lawyers’ Use of (and Refusal to Use) Social Media, 12 Del. L. Rev. 179, 183 (2011) (citing Am. Acad. of Matrimonial Lawyers, Big Surge in Social Networking Evidence Says Survey of Nation’s Top Divorce Lawyers, (Feb. 10, 2010)). 5 Duranti, Luciana, “From Digital Diplomatics to Digital Records Forensics”, Archivaria 68 (Fall): 39-66 (2009); Duranti, Luciana and Endicott-Popovsky,” Digital Records Forensics: A New Science and Academic Program for Forensics Readiness,” 5 Journal of Digital Forensics, Security and Law 2 (2010) 6 Matthew G. Kirschenbaum, Richard Ovenden, Gabriela Redwine (research assistance from Rachel Donahue) Digital Forensics and Born-Digital Content in Cultural Heritage Collections, Council on Library and Information Resources, December, 2010, http://www.clir.org/pubs/abstract/reports/pub149 (accessed July 23, 2012) 7 Barrouquere, Brett, “Kentucky woman sentenced for death of expectant mom,” Associated Press, http://www.kentucky.com/2012/03/02/2091640/kentucky-woman-sentenced-for-death.html (Accessed August 24, 2012) 2 Eventually she confessed and showed where she had immobilized the victim, bound her and removed the baby from the victim’s abdomen. The digital evidence identified the victim, confirmed that the suspect was not pregnant, located the victim and showed premeditation. This case demonstrates how digital evidence can be interwoven into the fabric of most types of criminal investigation. But time, funding or access needed for a thorough digital forensics examination are concerns in all cases, whether law enforcement or civil authorities. A two-tier technical problem continues to create backlogs in examinations despite the ever-increasing power of forensic computers. Without a solution to these problems the forensic examinations will face continuing challenges as to resources. First, the increase in the average size of hard drives in the typical digital case is outpacing the speed and processing power of the forensic computers.8 What was once considered an extra-large hard drive a few years ago now comes standard on most computers. But the power of computer processors and their ability to examine more data in less time has failed to grow at a similar rate. Any benefit a new forensic computer gives the examiner in its ability to process more data at a faster rate may be lost due to new larger hard drives that take longer to process. The second issue has been the proliferation and ubiquity of mobile devices. A few years ago a typical case contained one computer and, perhaps, some type of external media. Now the average adult has more than one type of electronic device; a typical case contains multiple items like a laptop computer, cell phone, tablet computer and related media. Each cell phone may potentially be broken down into three pieces of evidence: the cellular device, a SIM card and a SD card. Each item can contain data and must be examined separately. A cellular device overall could have up to 64 GB of data stored locally and 32 GB stored on the external media. The cell device examination alone may address 100 GB of information. Various models of collaborative and distributed digital investigation have been discussed and implemented for addressing this growth in ubiquitous electronic evidence. One example is the Regional Computer Forensic Laboratory (RCFL) program of the United States Federal Bureau of Investigation (FBI), involving regional collaborations of the FBI with state, regional and local law enforcement to provide centralized, highly trained digital forensic services. The laboratories are designed to provide centralized access to expertise and services in digital forensics. Yet as the demand for digital forensic services has grown, so has the need to develop and expand such expertise to local agencies. The

Load more

  15

Copy Link