Tuesday, 19 August 2008

Some vital evidence is ephemeral and often destroyed by conventional forensic investigator practices, Vince Gallo, Head of Forensic Technology at Detica Forensics, will tell the annual gathering of global security experts at COSAC in Ireland in September 2008.

Calling for a review of working practices and additional training for forensic investigators, Gallo will explain how live data capture is playing an increasing role in investigations and the particular skills and experience required for the job.

“The traditional guidelines for seizure of suspect computers focuses on the preservation of evidence by switching off the computer – but this risks losing vital transient evidence especially when encrypted data is involved,” explained Vince Gallo. “Crucial evidence is therefore destroyed by following the very practices that are supposed to preserve it!”

Gallo advocates modifying the guidelines to more explicitly encourage investigators with the requisite skills to examine live machines.

“While the ACPO guidelines recognise the potential value of capturing volatile data, many investigations require the input of new skills, experience and, without such skills, many investigators are unwilling to risk live data capture,” added Gallo. “They may therefore be missing vital data.”

Gallo continued: “Some of the usual forensic tools simply aren’t suited to live investigations and alternative strategies and methods need to be deployed. The Detica Forensics Live Data Capture Team has been involved in several live investigations recently and has had to overcome a new set of challenges.”