program specific sole source X-Ways.docx

ISPFS Digital Forensic Unit Software Use and Sole-Source Letter on X-Ways Forensics Software/tool that provides full extraction/acquisition/capture of data from a computer without changing or compromising any of the original data (forensic) on the original device. Software/tools then assist examiners in the analysis of the data captured in a forensic manner.

In every case, all software listed here is not employed until proper right-to-search documentation (search warrant, written consent, documented verbal consent) is granted by the courts or the owner of the digital device.

Examiners are trained on how to convert lines of computer code to interpretable data long hand but, tools that perform these conversions/interpretations save examiners hours of tedious effort and speed up examinations and ease navigation of increasingly larger amounts of data extracted from digital devices. Forensic software/tools convert digital evidence and/or cellular device/computer code to a human-interpretable format.

Successful analysis of device data of course relies upon the software/tools but of equal import is the associated examiner certification training; not just in the operation of forensic software but also training in the complexities of file architecture of an operating system specific to a given device.

Due to substantial hardware/software architecture and format differences, there are really three divisions of device types of data acquisition/extraction: computers/memory devices, cellular devices, and video/audio data/devices. Due to format differences within all three of these device types, DFU requires a number of specialized tools for each device type. X-Ways is strictly used for data acquisition/extraction from computers and associated memory devices and can be used for analysis of cellular data. X-Ways is not used for video/audio extraction/analysis.

In order to ensure each software/tool is operating properly, DFU conducts performance verification testing of all software/tools against a known data set (called a “reference”) then testing another tool of the same category of application with the same reference to replicate the results on the reference from software to software within a narrow mean. DFU performance verifications can take up to a week to conduct.

All examinations are potentially subject to court trial. DFU Examiners also must be “performance verified” via rigorous training and certification in the software/tools/examination techniques that are in-use in the lab. Certification training and testing must be completed for each DFU Examiner on software already in service for performance verification and courtroom testimony purposes. These training courses, certifications, re-certifications, and tests can be very expensive (tuition for just one of these classes commonly ranges from $2,000 to $7,000); not to mention associated time/travel/lodging costs incurred to attend the training. ISPFS has already spent thousands of dollars on tuition and travel to attain certifications that are directly attached to the forensic software in-use; these certifications are not transferrable to a separate software/tool.

Data Extraction/Analysis Tools in DFU Lab Use For Computers/Associated Memory Media:

X-Ways (Annual license, $1,550 per license/per year, two licenses in use) (Associated training, $2,200 per course)

· Description

· Software that can perform a full forensic extraction/acquisition of all data contained on a memory device (e.g., computer hard disk drive) and analysis of extracted data.

· Business Need

· Software/tool that provides full extraction/acquisition/capture of computer data from the first bit of data to the last without changing or compromising any of the original data (forensic) on the original device. Examiners are trained on how to convert lines of computer code to interpretable data long hand but, tools that perform these conversions/interpretations save examiners hours of tedious effort and speed up examinations and ease navigation of increasingly larger amounts of data in memory. These notable tools include: text/code search tools with filters); image searches (with specialized capabilities); flexible file organization/exclusion; video file searches; recognition of a most file structures; code/compound file/database parsing; file extension mismatch; data categorization; registry parsing; peripheral device/WiFi network parsing; file concatenation; hash algorithm; searches by hash/characteristic; partition recovery; BitLocker recognition; correlating activity across multiple digital devices yields pattern identification; and regular updates to keep pace with technology development. Capability to analyze multiple devices’ data simultaneously and find related content and patterns a plus. Capability to parse out raw digital data, regardless of source, a plus.

· Unique Properties

· X-Ways can perform verified computer data extraction from a wide variety of devices, regardless of source. X-Ways is commonly used to parse our for analysis specific data from cellular devices.

· One of the best price points for such a powerful and full featured forensic tool on the market. Considered an industry standard.

· In addition, X-Ways can also be used to simultaneously analyze computer, other devices, and parse out certain types of cellular device data.

· Alternatives

· Magnet Axiom (Currently in use by DFU. Annual license, $5,750 per license/year, currently two licenses in use, also considered an industry gold standard). (Associated training, $3,900 per course) Like X-Ways, Axiom can perform a full forensic extraction/acquisition of all data contained on a memory device (e.g., computer hard disk drive) and analyze the data. Axiom can be used to analyze computer, digital devices, AND cellular device data. DFU Examiners are certified and trained in Axiom as well. Axiom has been performance verified and approved for use in the DFU lab.

· Belkasoft X Computer (requires purchase of an annual license) ($1,200/year) (Associated training, $1,000 per course) The manufacturer claims all the extraction capabilities of X-Ways, however, per the industry, not nearly as robust a data analysis tool as X-Ways. Would require an additional separate software/annual license to analyze cellular device data. Would require examiners to re-train/re-certify. Would require a new performance verification to be approved for lab use.

· Detego Field Triage Computer (requires purchase of an annual license, $1,200/year) (Associated training, $1,000 per course) The manufacturer claims all the extraction capabilities of X-Ways, however, per the industry, not nearly as robust a data analysis tool as X-Ways. Would require an additional separate software/annual license to analyze cellular device data. Would require examiners to re-train/re-certify. Would require a new performance verification to be approved for lab use.

· FTK Forensic Tool Kit (requires purchase of an annual license, $5,175/year) (Associated training, $3,450 for year subscription to training catalog) The manufacturer claims all the extraction capabilities of X-Ways, however, per the industry, not nearly as robust a data analysis tool as X-Ways. Would require an additional separate software/annual license to analyze cellular device data. Would require examiners to re-train/re-certify. Would require a new performance verification to be approved for lab use.

· OpenText EnCase (requires purchase of an annual license, $4,000/year) (Associated training, $3,000 per course) The manufacturer claims all the extraction capabilities of X-Ways, however, per the industry and DFU experience, not nearly as robust a data analysis tool as X-Ways. Would require additional separate software to analyze cellular device data. DFU used EnCase heavily until about ten years ago. DFU determined loss of efficacy in casework. Would require examiners to re-train/re-certify. Would require a new performance verification to be approved for lab use.

· Get Data Forensic Explorer (FEX) (requires purchase of an annual license, $2,695/year) (Associated training, $3,500 per course) The manufacturer claims all the extraction capabilities of X-Ways, however, per the industry and DFU experience, not nearly as robust a data analysis tool as X-Ways. FEX does not offer a cellular device examination module. One DFU Examiner used FEX heavily on a full license trial basis during a competency test. DFU found FEX deficient in the analysis tools when compared with Axiom and X-Ways in use in DFU. Would require examiners to re-train/re-certify to use in the lab. Would require a new performance verification to be approved for lab use.

· Notes

· DFU Examiners are certified and trained in X-Ways.

· X-Ways is currently performance verified and approved for use in the DFU lab.

· DFU uses alternative software to cross check performance (called a performance verification) on a known test hard drive or cellular phone to ensure scientific repeatable results within a mean of 90%. This is one of the reasons why DFU employs more than one type of software.