Soft Data Forensic Analysis

Information stored on a computer hard disk for example is soft data.. in that the information can be easily changed and/or deleted. Recovering the information is often the easy job, but deciphering the information is much harder. There are many systems and protocols for the encryption and decryption of data and many of which present a very high degree of resistance to compromise. However, most computer systems during their operation leak large amounts of data to unprotected areas of the storage medium and this information can often be useful. Another recent technique employed, especially by criminals with data encryption knowledge is what we call Hot Data. Hot Data is the storage of confidential information in RAM and NOT on the hard disk. This method of storage provides almost certain protection from discovery as during a raid the Police will probably just pull the plug on everything and take it away, ensuring the data is destroyed. A variation of Hot Data is a system where data is stored on the hard disk, but the key required to decrypt it is stored ONLY in RAM and changes every time the computer is reloaded. Whatever the method of protection, interception at the CORRECT MOMENT is critical.

Hard Data Forensic Analysis

Information that is stored on paper, burnt onto CD or DVD, or spoken in code are all examples of Hard Data. Its "Hard" because it can't be easily changed and as such is likely to be static. Recovery and deciphering of hard data often requires information from two or more sources and this distributed method of protection is what presents the challenge. Correct identification of the cipher used and the method used to protect that cipher are just as, if not more important than the cipher itself.

Digital Surveillance

Whilst digital communications should make it easier to monitor and record activity of known or unknown individuals, it is often not the case as the wide availability of encryption technologies such as S/MIME, PGP, and seemingly impenetrable algorithms such as Blowfish make the job considerably harder. There is however always a point at which the information MUST travel unencrypted and interception at this point is by far the best strategy. For Counter-Surveillance systems and services see Data Security.

Forensic Analysis and Reporting

The process of recovery and analysis is often a complex one, but the process generally follows this procedure.

• 1. Extract the raw data from the medium upon which it is stored.
• 2. Extract/Decipher/decrypt information contained in the raw sample.
• 3. Identify the subject and meaning of the now human readable data.
• 4. Document the entire process thoroughly such that it may be used in evidence.

Upon completion of any assignment, the information in all its various forms together with our documentation and reports is supplied back to the client in electronic form. We do not keep a record of ANY information relating to any previous cases.

Contact us for more information.