Table of Contents 

Executive Summary

This is the report of the workshops on forensic implications (D.6.5) and profiling (D6.6) that have been held in Amsterdam at 14th of September 2005. The workshops were part of the ENFSI Forensic IT working group meeting, integrating members of the FIDIS consortium and of the ENFSI organisation.

Within this document, an overview is given of deliverable D6.1 on forensic implications and comments for the revision where also taken here. Furthermore presentations where given on profiling issues and the due process, building the starting point for deliverable D 6.7 on forensic profiling. 

The workshop

These are the notes on the combined FIT-WG, FIDIS and IOCE conference proceedings and further information in relation to the contents of each person’s presentation are available of the conference and will also be available on the FIDIS website.

The first day of this conference was open to FIDIS participants together with FIT-WG and IOCE members and any other registrations. 

Richard Koning from the NFI (NL) thanked all participants for their attendance and wished them an enjoyable and enlightening meeting. He was followed by Zeno Geradts NFI (NL) who gave an introduction to the FIDIS NoE, its “raison d’être” and the implications for the forensic community.

Presentation 1: The use of memory analysis in the recovery of digital data from mobile phone equipment.

The first talk was presented by Seyton Bradford, Forensic Telecommunication Services (UK). His presentation was focused on his organisation’s research and development work. The goal of this work is to automatically manipulate the hexadecimal encoded (HEX) data obtained from the memory chips of mobile phones. This HEX data can be extracted by a variety of methods, including the removal of integrated circuits (IC) from the circuit board and using IC programmers to do the actual data extraction. 

Such methods allow to retrieve far more data than connecting the mobile handset to a PC with a cable: in addition to user-accessible data (including multimedia files), erased data and administration-level data can also be retrieved in many cases (security code, former IMEI, used IMSI, etc.). 

A software program (FTS Hex) has been written to search and manipulate the stored data, enabling its user to output it into a standard format, independent of the brand or the model of the mobile phone. Currently, the application covers approximately 70% of the mobile phone market in the UK, and will be expanded to deal with more in the future. The examination of a mobile phone by FTS is charged approximately £100 (145 Euro), and FTS Hex software may be sold to law enforcement agencies in the near future. 

Presentation 2: Time stamp interpretation in relation to identity

The second presentation was by Svein Ingvar Willassen from the Norwegian University of Science and Technology (Norway). This was the first of two presentations from Svein and this presentation was on the interpretation of time stamps. Svein is currently only six months into this research topic – This research is being carried out for a three-year duration PhD thesis and will hopefully improve the understanding of time stamps to enable them to be better used in evidence. Purdue University (USA) and private company iBAS also contribute to the project, called “TID – Timestamps In Digital forensics” (TID means time in Norwegian). 

Up to date, Svein focused specifically on dates in FAT and NTFS filesystems (file last modified date, file last accessed date, file created date, MFT last modified date). 

Time stamps can present many problems, including different computers having different time stamps, which may or may not correlate, miss-adjusted clocks (accidental or deliberate), non-synchronisation of time clocks and the fact that different applications will handle time stamps in different ways. 

Presentation 3: Biometric devices methods for spoofing and circumventing

The third presentation by Arnout Ruifrok from the NFI (NL) was on Biometric Devices, methods for Spoofing, and circumventing. Biometrics is defined as the (automatic) identification of an individual’s identity by electronic means. There are a number of identification modalities including, facial, fingerprint, iris, hand scans, vascular pattern, signature writing, speech, and keystroke analysis. 

Each of these systems has different false acceptance rates and false rejection rates. Three systems were looked at in detail: Facial, fingerprint and iris recognition systems. Each of these have their own individual problems – i.e. facial recognition systems will have difficulties in operating correctly as a result of different lighting conditions, pose and position of the subject, the background and also the expression on a persons face. 

Presentation 4: Profiling issues and due process

The fourth and last presentation was held by Prof. Paul de Hert, Vrije Universiteit Brussel (Belgium). His presentation was on profiling issues and the due process – an European perspective. According to Paul de Hert, profiling is the use of previous criminal cases database to point out possible correlations with a current criminal case and identify potential suspects. Such methods are widely used in the insurance field by private companies (e.g. car and driver insurance). 

Privacy of an individual is something, which is supported by the European Convention for the Protection of Human Rights. This privacy becomes a blocking power and prevents the ‘State’ from doing what it wishes in relation to investigation of an individual. 

However since 9/11, governments throughout Europe and the rest of the world have a need to protect the general public from those that would do it harm. This requires the governments to access information and it is this access which has to be controlled. One of the forms of control is the use of data protection legislation. The issue of an individual’s right for privacy and anonymity is something, which still needs to be addressed with the greater use of biometric systems being introduced. 

Discussion Session

A discussion session was chaired by Zeno Geradts NFI (NL) discussing the issues raised during the day. The session also dealt with issues surrounding future research fields in forensics. One of the issues is that most forensic labs do not often search in data, and that most often this is handled by the police. For Paul de Hert some case examples were extracted which were of interest to him.  

Annex 1: Participants

Persons in cursive are member of FIDIS.