Use of IT Resources for Evidence Gathering & Analysis Use of IT Resources for Evidence Gathering & Analysis Raymond SO Wing-keung Assistant Director Independent Commission Against Corruption Hong Kong Special Administrative Region, China Raymond SO Wing-keung Assistant Director Independent Commission Against Corruption Hong Kong Special Administrative Region, China APEC ACT Workshop, Santiago, Chile 11th-13th June 2013 APEC ACT Workshop, Santiago, Chile 11th-13th June 2013

2 Computing Devices

3 Social Networking Tools

4 370,000+ Minutes Voice Calls 98,000+ Tweets 100+ New Accounts 80,000+ Wall Posts 510,000+ Comments 6,600+ Pictures Uploaded 600+ Videos (25 Hours+) Uploaded 168+ Million s Sent 700,000+ Search Queries (Source: Go-Globe.com) Every 60 Seconds on the Internet

5 Why Criminals Use IT Share information Multi-national communication Swift action Hiding identity Process and storage of large amount of data ………………….ultimately to avoid detection

6 How do we use IT resources?

7 Digital Forensics Data acquisition, recovery, preservation and examination Computer – –Document file… Mobile phone –Call history –Contact list –Short message – –Photo –WhatsApp

8 Mobile Digital Forensics Laboratory Shielded environment to block communication, e.g. remote wipe

9 Faraday Bags

10 Technical Tools Data recovery –Recover deleted files Information analysis –Call records –SMS – … –WhatsApp

11 Data Recovery Tool

12 Call Record Analysis

13 SMS Analysis

14 Analysis

ultinational Fast Food Managing Director Accepted Bribes

16 Record Digitization System Handled > 100,000 pages of bank statement each year Automatic conversion of statements/records in pre-defined templates into Excel files Developed by internal IT experts

17

18 R. D. S.

19 Centralized Storage of Digital Exhibits Storage Area Network (SAN) –Over 250TB storage –Connected by fibre channel Multiple examiners can work collaboratively on one case

20 ISP Enquiry Internet Service Provider (ISP) may provide –Subscriber information –Login IP address: for tracing physical location and subscriber information – content: usually court warrant is needed –How about ISP or their servers in other jurisdictions? Mutual Legal Assistance

21 Challenges (1) Technical difficulties Cloud computing –Information and evidence are remotely stored –Liaison with online service providers Huge data size –Storage Area Network (SAN) to keep forensic image Data encryption –Password cracking tool –Chip level data acquisition

22 Challenges (2) Admissibility of digital evidence Local digital evidence Foreign digital evidence Expert opinion on chain of evidence Admissibility of evidence in court trials

23 The Way Ahead Capacity Building Dedicated expert teams Training Collaboration with IT counterparts

24 The Way Ahead International Cooperation Formal Cooperation – UNCAC Informal Channels – APEC

Thank You