Open Source Forensic Software: A Major Digital Forensics Advance

Introduction

Of the many new technologies introduced into digital forensics in the last five years, open source forensic software has been the most significant in its contributions to forensic analysis, the prevention of crime, and the solving of criminal cases. Open source forensic software is today being used for the identification of unauthorized access, the presentation and analysis of access points, and the capturing of a cybertrail that can be used as evidence in U.S. courts (Volonino, 2003). This is significant because open source software was initially perceived by the broader IT community as lacking the security, reliability, and support of proprietary software (Muller-Seitz & Roger, 2009). Despite this reputation, however, adoption continues to outpace that of proprietary software. Enterprise software companies including Microsoft, Oracle, SAP, and others have specifically developed extensions to their own applications to capitalize on the economic benefits and rapid pace of innovation that open source software provides. These are the same dynamics that are serving as the catalyst for rapid adoption and continual innovation of open source forensic software.

The intent of this analysis is to evaluate why open source forensic software is important, how it is proving useful to corporations and law enforcement in fighting — and in some cases alleviating — computer crime, and how its use supports the three steps of gathering digital evidence. Included in those three steps are approaches to acquiring, auditing, authenticating, and analyzing digital evidence so that it can be used in a court of law.

The Increasing Importance of Open Source Forensic Software

The escalating rate of computer-based crime — in the form of agents, Trojan viruses, bots, and automated web services that seek to capture personal information online and gain access to secured banking, financial services, and military installations — is growing at an exponential rate. The rate of growth of these threats is surpassing the ability of security agencies and software firms to counter them (Abel, 2009). Amid this rapid growth of all forms of internet-based crime, there have been only partially successful attempts from leading software security firms to alleviate this problem (Erickson, 2009). Ironically, proprietary software is not scaling fast enough — either from a functionality or a market adoption standpoint — to keep up with the onslaught of security weaknesses throughout the myriad process workflow areas of the web and its many banking, e-commerce, financial services, and government sites. Open source forensic software, despite criticisms regarding security, reliability, and support (Abel, 2009), continues to be more agile as a development platform in responding to these threats. As a result, open source forensics software has progressed from a perceived fad to an enterprise-wide application solution (Rogers, 2003).

Open source forensics software also has a significantly lower Total Cost of Ownership (TCO) and a rapidly expanding base of development support, both of which combine to create an exceptionally strong catalyst for faster innovation (Bates, 1997). For budget-constrained companies and municipal, state, and federal organizations, this lower TCO has been one of the key business drivers favoring adoption. The perceived vulnerabilities of open source software — specifically its support of security standards common across digital forensics (Forte, 2008) — have been validated through a series of performance audits (Irons, 2006). These audits have shown that open source software is just as secure as proprietary software and, in some cases, even more so, given the configuration management choices made by programmers during coding and completion of the open source forensic software.

More fundamentally, open source forensic software has demonstrated the ability to scale from an architectural standpoint to support the rules-based approaches that forensic analysis requires for the digital evidence gathering process (Berghel, 2003). The foundation of forensics software is a series of constraint and rules engines that seek to define the optimal evidentiary path to a valid conclusion (Bates, 1997). Depending on the design philosophy of the forensics software, the entire application could be based on either rules-based engines or constraint engines (Irons, 2006). It is rare to find software that mixes both rules and constraints, as this would require modeling of each actual scenario being investigated. The majority of forensics software is rules-based, where each aspect of the digital evidence gathering process is defined as a set of conditional statements (O'Connor, 2005). These rules do not vary significantly from one application to another; specific logic workflows are defined and applied across the entire spectrum of digital forensics applications and tools. As a result, there is little, if any, variation in the security and reliability of open source forensics applications.

Both private and public organizations — including municipal, state, and federal agencies — consider this factor alongside TCO analysis in their due diligence evaluations of open source forensic software, and consistently determine that the price-to-performance ratio of open source-based applications meets their needs. The need for training and continual development expertise is certainly a factor, yet the lower TCO and broader community of development teams make this more affordable compared to proprietary forensics software (O'Connor, 2005). In many instances, larger organizations license the source code and complete their own customizations — a process that would be quite expensive with proprietary software. Such customization to the precise needs of any given organization or government agency would be cost-prohibitive with many proprietary software companies (Erickson, 2009).

Conclusion

The use of open source forensic software will continue to grow rapidly as business factors — including lower TCO and the continual improvement of software through collaborative development communities — persist. There is also a compelling need to keep digital forensics open sourced in order to enable greater levels of creativity and innovation in response to the rapidly rising sophistication and strength of threats (Abel, 2009). Open source forensic software, like enterprise-wide open source software more broadly, has undergone a transformation from being initially perceived as lacking in security, reliability, and support. Like its enterprise software counterpart, however, it has emerged from these perceived shortcomings to become an essential component of broader enterprise digital forensic analysis and evidence platforms in both private and public organizations (Barbin & Patzakis, 2002).

References

Abel, W. (2009). Agents, Trojans and tags: The next generation of investigators. International Review of Law, Computers & Technology, 23(1/2), 99.

Barbin, D., & Patzakis, J. (2002). Computer forensics emerges as an integral component of an enterprise information assurance program. Information Systems Control Journal, 3, 25–27.

Barret, N. (2004). Computer forensics an introduction. Records Management Society Bulletin, 121, 9–10.

Bates, J. (1997). Fundamentals of computer forensics. International Journal of Forensic Computing, December 2005.

Berghel, H. (2003). The discipline of internet forensics. Communications of the ACM, 46(8), 15–20.

Erickson, J. (2009, June). App dev that delivers. InformationWeek(1233), 35–39.

Forte, D. (2008). Dealing with forensic software vulnerabilities: Is anti-forensics a real danger? Network Security, 2008(12), 18–20.

Irons, A. (2006). Computer forensics and records management — compatible disciplines. Records Management Journal, 16(2), 102–112.

ISO 15489-1 (2001). Information and documentation — Records management. Part 1: General. International Standards Organisation, Geneva.

Muller-Seitz, G., & Roger, G. (2009). Is open source software living up to its promises? Insights for open innovation management from two open source software-inspired projects. R&D Management, 39(4), 372.

Rogers, M. K. (2003). Computer forensics: Science or fad. Security Wire Digest, 5(65).

O'Connor, R. V. (2005). Software selection: Towards an understanding of forensic software tool selection in industrial practice. International Journal of Technology Policy and Management, 5(4), 311–329.

Volonino, L. (2003). Electronic evidence and computer forensics. Communications of the Association for Information Systems, 12, 457–468.