Digital Forensics - challenges and opportunities Marc Kirby Cranfield University

Health Warning Based on my experiences as a manager and practitioner since 2000 They are only my views, there are others Debatable… Which is the purpose of this session… “To get us thinking about the future and allow us to chart a course for the next few years” Fail to plan… plan to fail PPPPPP (Six Ps) or is it seven?

Digital Forensics - The challenges and opportunities

Practical Challenges (today!) Challenges Data quantity Data Preservation Connectivity Interconnectivity Data storage Disclosure to Courts / 3 rd parties Multiplicity of devices Encryption Steganography Field investigations (Internet Cafes) Covert Capabilities Blue sky / keeping up to date Operating Systems Vista

Management /Strategic Challenge Costs Budgets Staff retention Bringing big business on board ISP Liaison Disclosure to Courts / 3 rd parties Laws relating to computer crimes Terrorism / Organised Crime Rules of evidence Covert Capabilities Funding appropriate research Staff Recruitment Training pathways Official standards Vendor Liaison Are staff experts in everything?

Opportunities Loads Maybe Not at all

Opportunities……. It’s not all bad! Encryption Interconnectivity Vista Connectivity Data quantity Covert Ops The digital age is here and everyone is a part of it Sat Nav and the like

A Case in point Younis Tsouli described himself online as Terrorist 007 One of the most notorious cyber- jihadists in the world. He built websites and ran web forums for al-Qaeda and soon he became the main distributor of video material from in Iraq. He looked for home movies from US soldiers that would show the inside of US bases in Iraq, so they (al-Qaeda) could do a better job at launching attacks into those bases

Part of a PowerPoint presentation on how to make a car bomb found on Tsouli's laptop Example

"What it did show us was the extent to which they could conduct operational planning on the internet. It was the first virtual conspiracy to murder that we had seen," …… Peter Clarke of Scotland Yard. Lesson Organised Crime On the hard drives of two associates were 37,000 credit card details, including security codes. Used to fund web hosting and other disbursements

Proved through Digital forensic investigation of ……. Hard Drives USB memory CD/DVD Internet Café Mob Phones Documents Metadata Pictures Video IP records etc. etc.etc.

Challenge = Opportunity What some fear as our greatest challenges have turned into our greatest opportunities. Digital traces were left everywhere. Operating systems such as Vista are actually our best friends. It is really hard to destroy or hide data. Digital devices all connect much more easily than even seven years ago. USB / WiFi / Internet / Bluetooth.

Electronic Devices

Electronic Device

Case Study

Case Study Op Euphroe Background Financial sector of UK notices abnormal levels of PHISHING Mules recruited via web sites to work as agents for a “new Russian company”. Believed legitimate employment Credit Card &other data obtained from unsuspecting public Used to clone cards / create false identities Cash or goods

Documents & Equipment  Create multiple identities such as US and UK Driving Licences.  MSR 2000 Card readers/encoders.  Fargo Printer to print Credit Cards and encode magnetic data.  Money Counting machine.

Thanks For your time and patience Marc Kirby Senior Lecturer in Forensic Computing