New Linux Tool to Aid Forensic Methods
Students in Australia developed a Linux-based data tool to help police churn through a backlog of computer-related criminal investigations.
The Linux tool was developed by students from Edith Cowan University's School of Computing and Information Sciences and should help the Western Australian Police Computer Crime Squad process forensic investigations.
Appropriately given the acronym / name SIMPLE (Simple Image Preview Live Environment), the software allows viewing and acquiring forensic data at the scene of the crime without compromising integrity as it is collected.
"It's a Linux Live CD built from the ground up. We customized the kernel and the underlying operating system so that when it runs it's incapable of writing to the hard disk or any other storage," Peter Hannay, the software developer behind the forensic acquisition tool, told ZDNet Australia.
The Linux operating system has had some features removed so that investigators can view data without affecting the host machine.
"We stripped out a large amount of the functionality to maintain the integrity of data collected, so we removed all network support and the ability to write to disk. Also, if for some reason a disk is writeable, then the system will halt automatically," Hannay added.
The developer of the product also noted that: "Our software will launch on top of the operating system and will interrogate the hard disk, locate all the images on system and then present those to the operator."
Such a product clearly illustrates the emerging role of IT and computer systems management in the field of criminal investigations.
Continue reading this article here ...
