Special Report | NIST’s goal: Keep digital evidence fresh

Scientists at the National Institute of Standards and Technology are known for sweating the nitty-gritty details of dull but vital standards for everything from bulletproof vests to medical measurement devices and IT encryption.And now, agency experts are bringing the same precision to computer forensics, fully aware that the final say lies in the notoriously low-tech realm of the judicial system.NIST’s efforts are two-pronged: a library of software applications and programs for testing the reliability of forensics tools.Since 2001, it has maintained the National Software Reference Library, with support from the Justice Department’s National Institute of Justice and law-enforcement agencies. NSRL is an actual library of CDs for 7,120 software applications.“We’ve got one of everything we could get our hands on,” said Douglas White, a computer scientist in NIST’s Information Technology Laboratory.NIST runs algorithms against the disks to generate digital “fingerprints,” or hashes, of files, for which it then creates a metadata index. The two together form the Computer Forensic Reference Data Set (RDS) for digital evidence. In a trial, if a court questions the RDS, NIST can prove its authenticity by regenerating the hashes.CDs usually aren’t loaned out. Keeping the originals “is very important for evidentiary purposes,” said John Tebbutt, another NSRL computer scientist. “We do not lend it out because we have to keep it under evidence locker conditions.”As of March, NIST reported, the RDS contained nearly 11 million hashes for three times as many files, and the Web site, , gets nearly a quarter-million hits a month.Law enforcement agencies and other computer forensics specialists pay $90 a year for quarterly updates.The RDS speeds investigations by identifying files that can be ignored—say, a Microsoft Office executable file. It also can highlight hidden and altered files.NIST staff members say NSRL is such a normal part of the daily work of forensics labs that they don’t typically hear success stories from subscribers. Ubiquity can be a better measure: White said the FBI sends copies to all its field offices.While the basic concept behind it hasn’t changed, NSRL is advancing in other ways. NIST is developing a process for hashing network files to address the increasing volume of evidence stored on servers, which are difficult to take into physical custody.“You have to do what’s called a live acquisition—acquiring the forensic information from a machine that’s actually running,” Tebbutt said.NIST also is working on hashes that operate on storage blocks, a potentially faster, more precise method than the black-and-white file hashes, which can be thrown off by minor file changes. White said block hashes will make it easier to exclude unimportant files. NIST has provided hashes to several states that hope to prevent software tampering in voting machines.NIST’s other effort is the Computer Forensics Tool Testing project, designed to ensure the capability of forensics testing tools.Lacking an industry standard, NIST had to improvise. “We started ... writing requirements for what we thought the different forensic functions should be,” said NIST computer scientist Jim Lyle. “We needed to come up with a list of acceptable tool behaviors and ... unacceptable tool behaviors.”Lyle said CFTT is limited in the testing it can do itself. The real value is in the test kit and test specifications it offers to other labs.“Ideally, a test lab will take that and test all the products out there,” Lyle said.Each product handles one of four main functions, though some, including the widely used EnCase from Guidance Software Inc. of Pasadena, Calif., have expanded beyond their original purpose.The first step is imaging: making a copy of a seized disk to use without touching the original. Forensics-grade tools go beyond run-of-the-mill utilities by adding hashing, checksums and other authentication technology that holds up in court.Next comes hard-drive write protection to prevent tampering; it is also available as a hardware device. The other two functions are deleted-file recovery and string-searching tools, which help find evidence on the disk. NIST has specifications and results for the first two and is developing them for the others, Lyle said.Unlike most computer technologies, forensics tools aren’t driven much by industry or vendor standards, according to Tim Leehealey, vice president of business and corporate development at Guidance Software.“What makes a tool or a process forensically sound is less about standards bodies and more about what courts will accept,” Leehealey said.But Lyle seems less sanguine, saying the full implications of the Supreme Court rulings, called the Daubert standard, on the admissibility of scientific expert testimony, are not yet clear. Under Daubert, federal judges now are required to control all scientific evidence, including technology. Judges are expected to analyze expert witnesses to ensure their statements are both “relevant” and “reliable.”The need for comprehensive standards only will increase if demand spreads to other areas such as the security of classified documents and detection of hackers, a trend Leehealey already sees from federal customers.“People have realized there are literally hundreds of reasons to conduct investigations,” he said.