From the Editor's Desk

Computer forensics is one of the new, hot topics in crime scene investigation. “Cyber Crime,” with the advent of the Internet, is on the rise in our society. Crimes such as child pornography have increased dramatically over the past decade with no end in sight. More and more evidence in these cases is being stored inside computers.

Unfortunately, not all of us are computer experts. As many of you can attest, local computer labs are generally backlogged to a point where it can takes months for computers to be properly processed and determined if they contain any evidence. Not every computer is going to store evidence. With the size of computer storage devices increasing, if the investigator at the lab doesn't know what to search for, it can takes days to search an entire computer.

In this issue of Minutiæ, we are proud to introduce some of the amazing products of NTI. The company has produced some of the most unique and useful products in the computer forensics industry. Designed by retired IRS-CID special agents with more than 50 years of combined criminal investigations and computer forensics experience, they provide a valuable tool to law enforcement in their fight against cyber criminals.

For those of you interested in becoming computer forensics professionals, NTI provides top-of-the-industry classes on computer forensics and expert witness testimony in the area of computer forensics. These thorough and in-depth classes will teach you how to properly uncover and present computer evidence.

Of course, not all of us want to become computer geniuses. Luckily, NTI provides a unique solution for those who are less familiar with computers. NTA Stealth™, GFE Stealth™ and FNames Stealth™ provide a suite of tools to allow investigators with little knowledge to quickly and easily pre-process computers for evidence. Pre-processing a computer allows the investigator to quickly determine which computers have evidence on them and which do not, allowing the professionals in the computer lab to process only those computers known to have evidence on them. Furthermore, it gives lab personnel an idea of what may be stored on the computer.

NTA Stealth™ allows investigators to quickly determine what type of internet traffic has been used on the computer. Its use provides a list of web sites and e-mail addresses that a computer has visited, including information that may have been hastily deleted. It does this without damaging or altering the precious bits and bytes on the computer, leaving it in the exact state it was in before pre-processing.

GFE Stealth™ can then be used to quickly discover images on the computer’s hard disk drive, including files that have been deleted. This is useful in child pornography and parole investigations. It run on a floppy diskette or USB jump drive for use in nearly every style of computer.

FNames™ Stealth can then be run to identify the names of individuals stored on a computer, including those that have been hidden or deleted. It was specifically designed to assist law enforcement in identity theft cases and in intelligence gathering.

Paroled sex offenders are often prohibited from having contact with certain individuals. Probation and parole officers may use FNames™ Stealth to determine whether the names of these prohibited individuals are on the offender’s computer, thus indicating possible unauthorized contact by the offender with those associates. It can also provide crucial leads in kidnapping cases, giving you the names of individuals and associates connected to the suspect. FNames™ Stealth uses a form of artificial intelligence to quickly identify both English and Arabic first, middle and last names, as well as titles associated with a name and certain European formats of names.

By pre-processing a computer that you suspect may hold relevant information, you can help stem the tide of cyber-crime. By using tools that don't change the computers information, you make your local computers labs more effective and efficient, providing you with a quicker turn-around on cases and putting more criminals behind bars.

Mr. Schaffer joined the Armor Forensics team in 2003 to assist with computer forensics training and internal security programs. He has more than 20 years of experience in developing hardware and software for information and communication systems. He resides in Beaverton, Oregon and can be reached at kim@forensics-intl.com