Linux tool speeds up computer forensics for cops

Linux tool speeds up computer forensics for cops

Summary: Australian students build Linux-based tool that allows investigators to collect forensic data without compromising its integrity.

SHARE:

Australian university students have developed a Linux-based data forensics tool to help police churn through a growing backlog of computer-related criminal investigations.

The tool was developed by students from Edith Cowan University's School of Computing and Information Sciences and will help the Western Australian Police Computer Crime Squad process their forensic investigations.

Called Simple (for Simple Image Preview Live Environment), the software allows investigators to view and acquire forensic data at the scene of the crime without compromising the integrity of data as it is collected.

"It's a Linux Live CD that we have built from the ground up. We customized the kernel and the underlying operating system so that when it runs it's incapable of writing to the hard disk or any other storage," Peter Hannay, the software developer behind the forensic acquisition tool told ZDNet Asia sister site ZDNet Australia.

The operating system has had some features removed so that investigators can view data without affecting the host machine.

"We stripped out a large amount of functionality because we want to maintain the integrity of data collected, so we removed all network support and the ability to write to disk. Also, if for some reason a disk is writeable, the system will halt automatically," he added.

"Our software will launch on top of the operating system and will interrogate the hard disk, locate all the images on system and then present those to the operator."

The Simple tool searches the system for specific file types like MPEG or JPEG files, saving time on the often lengthy search process.

Hoping to achieve even greater automation during the collection of evidence, Simple will soon be equipped with skin-tone analysis capabilities to help detect relevant files.

The idea for the tool first came when the Western Australian Police approached the university in 2006, since its investigators could not handle the amount of computer forensic data requests, which relate mostly to child pornography and bestiality.

Normally police need to take the PCs back to the station to begin acquiring forensic data, but with this tool, according to Hannay, police will be able to collect the data on the spot.

Topics: Software, Open Source, Operating Systems

Liam Tung

About Liam Tung

Liam Tung is an Australian business technology journalist living a few too many Swedish miles north of Stockholm for his liking. He gained a bachelors degree in economics and arts (cultural studies) at Sydney's Macquarie University, but hacked (without Norse or malicious code for that matter) his way into a career as an enterprise tech, security and telecommunications journalist with ZDNet Australia. These days Liam is a full time freelance technology journalist who writes for several publications.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

4 comments
Log in or register to join the discussion
  • Link to project?

    Is there a link to the project? I would like to find more information on this.
    anonymous
  • Link Info

    http://secau.scis.ecu.edu.au/projects/index.aspx for the project.
    anonymous
  • Project available?

    Hi,
    the project is it available to the general public? Is it possible to recover the LiveCD?
    thanks for all.
    anonymous
  • Forensics

    This is stupid.
    Suppose some criminal is already using some live distro like puppy linux or slax or even knoppix ????.
    What if there is no hard drive on the sata cable and the entire system revolves around DVD's or CD's???
    Suppose the criminal just uses the Live CD/DVD on a situational basis when she/he is visiting a site like oooooh Prisonplanet.com or infowars.com
    anonymous