Presentation on theme: "Adroit Photo Forensics 2013 How Adroit Photo Forensics can assist forensic examiners in every stage of an investigation involving photos. Get the Complete."— Presentation transcript:
Adroit Photo Forensics 2013 How Adroit Photo Forensics can assist forensic examiners in every stage of an investigation involving photos. Get the Complete Forensic Picture!
Photo Recovery - Active Adroit Photo Forensics provides Active recovery for the following file systems: FAT12/16/32 NTFS HFS HFS+ All other file systems are carved.
Photo Recovery - Carving APF can recover photo evidence that no other forensic product can! Validated Carving: Verifies that the photos follow the rules of the format NTFS/FAT Log Carving: Uses NTFS logs to validate and carve deleted photos SmartCarving: Automatic recovery of fragmented photos. GuidedCarving: Manual assisted recovery of fragmented photos. Size Carving: Specialized recovery of BMPs, TIFFs and RAWs.
Importance of complete carving On average 16-20% of photos are fragmented. Every additional picture recovered can contain: Potential Suspects Potential Leads Potential Victims Potential Locations Missing timeline information Fragmented Recovery Traditional Forensic Tools Fragmented Recovery Adroit Photo Forensics
Embedded Carving Specialized Embedded Validated Carving for: MS Office PK-ZIP Thumbnail Cache (XP, Vista & Windows 7) Generic Embedded Validated Carving for: All other files Sector Carving/Byte Carving: After carving and active recovery at the cluster level, APF removes all validated files. Remaining clusters are carved at the sector or byte levels.
Recovery Profiles A Recovery Profile contains a set of carving and analysis options. Can be quickly selected before starting a case. Built-in profiles for triage and detailed analysis built in. Create, Edit & Delete profiles. Profiles can be copied from one user to another.
Photo Formats Recovered Adroit Photo Forensics recovers photos taken by digital cameras: JPEG RAW – Canon, Sony, Olympus, Nikon etc. Adobe DNG TIFF Also recovers: PNG GIF BMP
Organization APF allows faster organization and processing of cases involving photos Traditional forensic applications are focused on text and files. APF has a dedicated and streamlined UI for photos. Forensic Photo Gallery provides the fastest and most powerful way to view and organize photos. Sort/Group/Filter based on important photo specific properties
Organization – Forensic Photo Gallery APF has a unique and powerful forensic photo gallery: Identify with one click Cameras used Image Manipulation Software (ex. Photoshop) EXIF Date/Times (Day, Month or Year) File name, folder and much much more Filter Photos By Photo Format Resolution (include/exclude thumbnails etc.) Ignore Status
Photo Gallery – Camera Grouping Grouping By Camera Filtering out thumbnails (4 Photos) Apple iPhone 4 (2 Photos) Nikon D100 Category User selected ! Hash Alert Bookmarked Possible actions for selected photos
Custom Gallery APF contains a custom gallery: View and sort user selected pictures. View and sort location or type specific photos like: Windows Thumbnail Cache Recycle Bin/Trashes Extension Mismatch Hash Alerts Bookmarks Ignored
Content Analysis There can be hundreds of thousands of photos in a single disk image. Analyzing them manually is just not efficient. Viewing photos by their thumbnails can still take a huge amount of time. Thumbnails are subject to anti-forensic attacks. So how do we save time and show an examiner only forensically important photos? SmartFiltering
SmartFilters present the most forensically relevant photos: Explicit Image Detection (Fast/Best) Face Detection Thumbnail Mismatch SmartHash MD5 Hash Alerts SmartHash Alerts
Explicit Image Detection 2 Modes of EID Best for detailed analysis Fast for triage (does not slow down recovery) Experimental Child Explicit Image Detector included Dynamic slider for reducing or increasing explicit images shown. Sort by skin percentage EID uses much more than skin analysis to reduce false positives and false negatives
Thumbnail Mismatch Criminals know that investigators maybe reviewing evidence via thumbnails. Investigators rarely have the time to view each photo in full detail. Illicit images can be hidden behind safe thumbnails! Easy to do Manually Photo applications like Photoshop Thumbnail Mismatch identifies those photos where the full image does not match with its thumbnail
MD5 Hash Alerts, SmartHashing Finding known illicit images, examiners normally use MD5 hashes APF has full support for MD5 hash alerts But what if the photo is slightly changed? MD5 Hash will not work. APF incorporates SmartHashing that finds photos even if: Resized Color changed Brightness changed Slightly Cropped/Rotated Touched up/Logo Insertion/Logo Removal
Photo Details APF has the most powerful forensic photo viewer on the market: Full Image Preview/Thumbnail Images Photo Header Details EXIF Metadata File System Information Categorization & Bookmark Info Summary Cluster/Fragment Linking
Photo Details - Timelines Generate zoomable time lines based on File Access Dates File Creation Dates File Modification Dates EXIF Date/Time Use EXIF Date/Times to get date time information even if files are deleted. Filter based on dates
Classification/Categorization Categorization is an important part of a forensic analysts work. APF categorization was built from the ground up to be FAST and powerful. APF includes built-in category profiles UK CP North American CP APF allows creation of custom profiles. Create rules to automatically categorize based on SmartFilters Use hot keys to efficiently categorize from any screen. Use categories to view/report/export/save/timeline photos. Adult Play CP Nudity
Categorization Flow Recovered Photo MD5 DB Check SmartHash DB Check EID Rules Check Lookup AdultOtherCPNudity Categorize Match Manual
Verify Integrity Full Viewable Logs Generate MD5/SHA1/SHA256 hashes of photos Do MD5/SHA1/SHA256 hashes of evidence before and after recovery Compare evidence hashes prior to recovery against current hashes and stored hashes (Encase Only)
Customizable reports File System Data Photo Details EXIF Details Thumbnails CSV Exporting File System Data Photo Details EXIF Details Thumbnails FTK KFF Exporting
Additional Features Batch Analysis for running multiple cases over night or over the weekend Ability to quickly blur thumbnails to prevent others from viewing photos. Full hotkey support for all major features. Built-in context sensitive help Certified Adroit Forensic Examiner (CAFE) training available
ADROIT PHOTO FORENSICS Contact Digital Assembly or an authorized reseller to provide you with a demo or additional information. Website: Phone: