What does “Forensic” mean

1. The Essential Conflict between “Computer” and “Forensics”Eur Ing Matthew W A Pemble CEngFBCS CITP FICAF MIET CISSP CFE CISM

2. What does “Forensic” mean • We understand “forensic” • (adv) Of, pertaining to, or used in a court of law, now /spec/. in relation to the detection of crime. or • (n) A speech or written thesis setting out one side of a question. US. • This could explain the abuse of “forensic” by American sales weasels. • Lawyers, judges and juries understand “forensic”

3. What about “Computer Forensics” We are: • Uglier than “Kay Scarpetta” • Thinner than “Cracker” • Have fewer guns than “CSI” • Better at stats than Dr Roy Meadows • Less likely to get ourselves sacked by writing a book than Prof Neil Barrett

4. “Why do I rob banks? Your honor, that’s where they keep the money.”

5. Issues with CF • Forensics is based on: • Analysis of the original • A (lawyers) understanding of the concept of “Best Evidence” (Springsteen case) • Expert evidence • “First Principles” science • Computers are based on: • Indistinguishably (relevantly) accurate copies everywhere • Permissions not people • Technicians not experts • Your bit of the technosphere

6. What is the “original” • I conduct a financial transaction from my laptop • Internet site; Websphere / Oracle; Z/OS Mainframe • Intranet site; 3270 emulation; Z/OS Mainframe • Where is the original? • RAM copy (long gone) • Virtual memory copy (probably overwritten) • Z/OS Backoffice (ever image a mainframe?) • What / which is a reasonable copy? • Hearsay exemption for business records • Challenge in days of trivial (undetectable) alteration?

7. Evidence & Statistics • Physical Evidence • Secure custody • Chain of evidence • Tamper-evident storage • Sign-in / sign-out • Original disks • Digital Evidence • Extract & hash • Sign (secure datestamp?) hash • Minimal subsequent requirement for security

8. Courts and Statistics • DNA Testing • Not permitted to adduce statistical arguments into court. • Roy Meadows • Correctly adduced statistical improbability of deaths not being linked • Incorrectly assumed only link could be murder • Current issues with hash algorithms • Encase still uses MD-5 • Could you argue stats in court regarding SHA-1?

9. Computer Action / Human Intent • This action was recorded on that computer • Did <any / a specific> human deliberately cause that action? • Prove “mens rea” • Specific intent is generally necessary for criminal conduct. • “somebody must have known my password” !  • Regina versus Snober (and others)

10. Forensics Training • Traditionally police & defense “expert witnesses” • Experience and closed (law enforcement) training • Vendor training • Irrelevant professional qualifications • Where now? • Public failures – Soham / Kelt • More aware lawyers & judges • Beginning academic discipline (Strathclyde et al) • National Occupational Standards • “Technically Competent Witness” – NVQ L3 or L4

11. “It is dangerous to assume malice in cases where incompetence is a valid explanation.”

12. Questions?