“I do not think that word means what you think it means”

–          Inigo Montoya, The Princess Bride

As with any other scientific specialty, computer investigations have their own lexicon of ideas and terms. Many of them are foreign enough that a layman will require an explanation just to understand them, but several are words with which most people will be familiar that have a distinct meaning in the context of forensic examination of electronic evidence.  Some of these are outlined below.

Image

Both the standard idea – “a picture” and the forensic meaning are used. The forensic term “image” refers to a forensically sound capture of evidence into a file format that allows for examination. It is an exact duplicate of the original device’s data, in a new format. “Bob took an image of the hard drive and then photographed an image of the computer from which it came.”

Acquire

Typically not used by experts in the traditional meaning “to obtain” but rather in the forensic sense “to obtain an image of (see above)” – when an expert says that they “acquired the hard drive” they normally mean that they made a forensic image of it, not that they got their hands on it.

Hash

Not the fried potatoes you have for breakfast, but a mathematical formula used to represent the unique fingerprint of a file.  “I compared the hashes of the two files and determined they were identical.”

Accessed

This is a particularly troublesome term.  In computer forensics, this indicates that the computer has ‘touched’ the file in some way, whether by a user or by the computer’s own internal programs.  Files are often “accessed” by things like virus scanners that occur without the user’s knowledge.  This is in distinct contrast to the layman’s concept of “accessed” on a computer – meaning a user interacted with a file, by opening it, for example.

Viewed

Like accessed, this term can be confusing and is often the source of misunderstanding by non-experts.  If an expert says that a web page is “viewed” they mean that it was loaded in a browser.  It does not necessarily indicate that human eyes saw the whole page – or indeed that any of it was actually seen.  Forensic analysis can sometimes give strong indications that a page was actually seen by human eyes – perhaps by showing that information on a page was followed by a web search of that information, or that a link in a page was clicked on – but ultimately, there is no incontrovertible evidence that a human being has “viewed” a web page on the computer.

Deleted

When we think about the phrase “deleted files” most of us think of this as an intentional action.  We imagine a user selecting some files and dragging them to the Recycle Bin or hitting their Delete key.  In actuality, deleted information can often be deleted by the normal operation of the computer, as is the case with Temporary Internet Files.  It is therefore important that the understanding of the term “deleted” and its usage in a particular situation be well-defined.

As you can see from these few examples, when using precise terms-of-art in a legal setting, it is crucial that the speaker and the listener both be understanding the term in the same way.  Ensuring this is the case is one of the keys to a successful computer forensic examination.

They say you always remember your first one.

The deceased was brought into the lab and laid out on a cold, hard table. Instruments were laid out on the table beside them, some eerily familiar and others strange and arcane. In a few moments, we were inside, looking at the innards that held the secrets to the end of a life cut short. What had happened that had struck this one down in his prime? Who was responsible?

A few minutes work and the major organs were out, sent on for further examination. All that was left was a shell – nothing left of what made this one glow in life.

Into the lab we went. Here, the organs had been hooked up to all manner of odd devices by a multitude of wires. Electricity coursed through the leads and the organs began to stir!  A scientist sat nearby, making notations on a pad about each item. Soon, each organ was functioning as it had in life. What story would they tell? Would we find the perpetrator of this dastardly deed? Would the victim have their revenge from beyond the grave?

They had separated the brain into its sections: short term memory here, long term there, thoughts over here, auditory center here, visual center there. Such a complex device! The long-term memory was connected through several wires into a box. From the box, another long wire led into a computer.

As the monitor began to flicker into operation, the most wondrous thing occurred! There before me on the screen were the victim’s memories! Here, we could see the moment of birth; over here were memories of a youth spent playing games with a close friend. The mood darkened. I saw memories of the friend – more sinister-looking now – involving our dear departed in some nefarious scheme. There were forged letters written, accounting entries backdated, fraud, deception and theft. The poor victim had no idea he was being used, so blindly he trusted his friend.

Our victim had been trusting, but he had not been a fool. All along, he had kept a journal. And oh what a journal it was! Every detail of his day had been written out in explicit detail. Every time the villain forged a letter, the true circumstances had been dutifully recorded in the journal. Every backdated document had it’s true date exposed. The minutiae of life was laid out truthfully, recorded simply for the sake of having an accurate record. I think his friend had realized it at some point. Unable to determine the location of the journal, he had instead decided to eliminate the journaler.

The fiend had turned on him. He had injected a deadly virus in hopes of destroying his memory. He had prattled on about all manner of bland things in an attempt to make the victim forget about what he had seen. He reset the clocks constantly – I suppose to drive him mad, or to confuse his journaling. Eventually, it came to violence – the trauma to the brain had been severe, leading to a quick and messy end.

Yet, our hapless victim was steadfast to the last. Each event was recorded with the same clarity, scribing a horrific story of the destruction of a faithful friend through the machinations of one who had fallen to a life of lies.

The trial was short. The entries in the journal peeled back the veneer of lies that had been presented by the defense in the case. In the end, the jury realized that the defendant had betrayed his faithful companion to cover up his crimes. He had taken advantage of the trust they had established and tried to use it against him. The evidence was overwhelming and irrefutable.

“Guilty,” the foreman intoned solemnly “of capital spoliation resulting in the death of a Dell Inspiron laptop.”

You always remember your first one, they say. I sure remember mine.

There is a tendency in the electronic evidence field to lose sight of the fact that, although the battleground is different, the way the war is fought is the same.  Electronic discovery motions are still discovery motions, destruction of electronic evidence is still spoliation and computer forensic investigations are still investigations.

Because of the jargon in the field and the general aura of complexity that surrounds computers, it’s not unusual in the electronic discovery industry to get tunnel vision regarding data and fail to get the bird’s-eye view of the case.

A law firm doesn’t “process some documents” – they review them. A large body of evidence is sorted in a specific way: duplicate items are cast off early in the review by people without any particular expertise in the law or the case. As the body of evidence becomes smaller, the difficulty of review goes up. More knowledgeable reviewers filter out irrelevant documents, further reducing the data. Finally, a reviewing attorney conducts a review, using their knowledge of the law and the details of the case to determine the relevancy and importance of documents and how they fit into the case. A meticulous review will often uncover facts that were previously unknown – often facts that nobody was even looking for.

In many cases, the tendency to view electronic discovery as a machine – hard drives go in this side, PDFs come out that side – does a great disservice to the e-discovery industry and the legal field as a whole. That is not to say document processing is not good – indeed, it’s vital to be able to quickly bring terabytes of data under control and extract relevant, reviewable evidence. It’s the industry’s growing reliance on software rather than people that are dangerous.

A computer’s greatest strength is also its greatest weakness: they do exactly what they are told to do. Tell a computer to determine if “akshul” is spelled correctly and it will search through a dictionary, apply some criteria common to English and ask if we mean “actual” instead. This is the strength in computing.  Regardless of the spelling ability of the operator, the computer knows the right answer.

However, ask a computer to correct this phrase: “eye sea ewe” and it will pass it on as perfectly spelled. Here is where the fault of over-reliance on software lies.  Even a schoolchild can identify this as out of place and interpret it correctly, but the computer simply does what it’s told to do: check each word and if it’s correctly spelled, move on.

Sophisticated software exists to mitigate some of these issues. “Fuzzy searching” allows you to enter keywords and returns hits that are “close” to what you’re searching for – perhaps a keyword was spelled wrong, with two letters reversed.  Fuzzy searching will return this as a possible hit for review. There is also software that uses “conceptual searching” – looking for ‘law’ also produces hits relating to ‘legal’ and ‘court’ – an amazing development that continues to grow more sophisticated.

At the top-end, software costing millions of dollars is trying to put some of the knowledge and experience of reviewers into a package that can automate a process that was once completely human. In many cases, it is astonishingly successful if it’s properly configured and implemented.

Still, fooling a computer is often easier than fooling a human. A computer looking for an email regarding illegal stock trades may have a host of keywords: ‘drop’ ‘price’ ‘downturn’ ‘bottom’ ‘loss’ ‘sell’ and so forth, but it won’t see what you do in this exchange:

“How’s it going today?”
“Everything is the Titanic today, jump ship.”

The message is clear as a bell, but our software passes right over it, foiled by the lack of human experience that Joe Everyman has.

In the end, digital investigation is still investigation. Between our ears, we have an amazingly powerful computer, continually upgraded and updated. Capable of nuanced understanding and on-the-fly decryption of previously unknown data, it has never been matched in the technological world. An expert investigator can provide information that is beyond the foreseeable capability of computer software. He can provide opinion answers to general questions, he can point to the absence of things that should be somewhere, he can identify deception, dishonesty and evasion and he can feed ideas into the case.

In the end, the strength of humans in electronic discovery is simply that they are humans.

Many people have seen advertisements on the internet offering software that will let you monitor activity on a computer. These ads bark “Catch a Cheating Spouse” or “Secretly Monitor Email” or “Spy on Your Computer.” In many circumstances, this type of software is not only sneaky, it’s criminal.

Common Features

There are many different types of monitoring and logging software and not all of them use the same methods or have the same results. Let’s look at some of the most common features:

Keylogging: Also called keystroke recording, this software intercepts every key pressed and records it. Because it doesn’t rely on anything visual, it can capture passwords that are obscured on screen as well as commands that don’t make a visual change, such as the CTRL-C command used by many applications to Copy something.

Screen Capture:  This can be event-based or time-based.  Every time the selected criteria is met, the software takes a screenshot (a picture of what’s displayed on the screen) and records it.  By looking at the screenshots, it is possible for a layperson to see information that would be difficult for them to find any other way (such as pornography.)

Window Capture: If one looks at the applications running on a computer, nearly all have a very clear “Title” in the upper-left hand corner. As this article is being written, the title visible on this computer is “When Snooping Becomes a Crime.doc – Microsoft Word”. Window capture applications log the title of open windows and the time and date they are opened and closed. This can produce a significant amount of detail into the activity on the computer, including names of webpages viewed, documents opened and emails sent and received.

It is not uncommon for monitoring software to have multiple methods of capturing and reporting information – indeed, many will have all the features noted above.

What the Law Says

The United States Code is the body of laws that are commonly referred to as “Federal Law”. In this case, 18 U.S.C. §1029, 18 U.S.C. §1030, 18 U.S.C §2510 and 18 U.S.C. §2701 are the applicable statutes. 18 U.S.C §1030 is part of the Fraud and False Statements chapter, 18 U.S.C §2510 is part of the Wire and Electronic Communications Interception chapter (a/k/a the Wiretap Act) and 18 U.S.C §2701 is part of the Stored Wire and Electronic Communications chapter.

Applying the law

Subsection (a)(2)(C) of 18 U.S.C §1030 states that one has committed a crime if he “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—information from any protected computer if the conduct involved an interstate or foreign communication;” In this case, any computer that accesses the internet is involved in interstate communication. Punishment is up to 10 years for a first offense.

Subsection (a)(2)(C) of 18 U.S.C §2510 states that one has committed a crime if he “intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication;” This is the whole purpose of the software in most cases. There are exemptions when the interceptor is a party to the communication or when one of the parties has given consent to the interception. This is why you see such wordy logon screens at corporations letting you know that you are consenting to monitoring. Punishment is up to 5 years for a first offense.

Subsection (a)(2)(C) of 18 U.S.C §2701 states that one has committed a crime if he “intentionally accesses without authorization a facility through which an electronic communication service is provided… and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system” This portion refers to things like logging into someone’s webmail account and reading or deleting emails or signing on to an instant messenger network as someone else and receiving saved Ims.  Punishment is up to 1 year for a first offense.

All three of these statutes also have civil fines associated with them, thousands of dollars in some cases. Add to this the cost of hiring an attorney to defend you in a criminal case and a separate attorney to defend you in your civil case and the costs could easily surpass $100,000 not counting what might be a sizable judgement should you lose the civil case.

In closing, be aware of the dangers when “investigating” your own computer and leave it to the professionals.