Adroit Photo Forensics 2013
How Adroit Photo Forensics can assist forensic examiners in every stage of an investigation involving photos.
Get the Complete Forensic Picture!
Photo Forensic Case StagesEvidence Acquisition Photo Recovery Organization Content Analysis
Photo Details
Adult
Obscenity
CP
Nudity
Classification/CategorizationVerify IntegrityReporting and Exporting
Evidence Acquisition• Adroit Photo Forensics (APF) supports :• Disk Images
• EnCase (E01) single/split images• DD/RAW/BIN single/split images
• Logical Drives• Physical Drives• Folders
Photo Forensic Case StagesEvidence Acquisition Photo Recovery Organization Content Analysis
Photo Details
Adult
Obscenity
CP
Nudity
Classification/CategorizationVerify IntegrityReporting and Exporting
Photo Recovery - Active• Adroit Photo Forensics provides
Active recovery for the following file systems:• FAT12/16/32• NTFS• HFS• HFS+• All other file systems are carved.
Photo Recovery - Carving• APF can recover photo evidence that
no other forensic product can! • Validated Carving: Verifies that the
photos follow the rules of the format• NTFS/FAT Log Carving: Uses NTFS logs
to validate and carve deleted photos• SmartCarving™: Automatic recovery of
fragmented photos.• GuidedCarving™: Manual assisted
recovery of fragmented photos.• Size Carving: Specialized recovery of
BMPs, TIFFs and RAWs.
Importance of complete carving• On average 16-20% of photos
are fragmented.• Every additional picture
recovered can contain:• Potential Suspects• Potential Leads• Potential Victims• Potential Locations• Missing timeline information
Fragmented Recovery Traditional Forensic Tools
Fragmented Recovery Adroit Photo Forensics
Embedded Carving• Specialized Embedded Validated Carving for:• MS Office• PK-ZIP• Thumbnail Cache (XP, Vista & Windows 7)
• Generic Embedded Validated Carving for:• All other files
• Sector Carving/Byte Carving:• After carving and active recovery at the cluster level, APF
removes all validated files. Remaining clusters are carved at the sector or byte levels.
Recovery Profiles• A Recovery Profile contains a
set of carving and analysis options.
• Can be quickly selected before starting a case.
• Built-in profiles for triage and detailed analysis built in.
• Create, Edit & Delete profiles.• Profiles can be copied from
one user to another.
Photo Formats Recovered• Adroit Photo Forensics recovers
photos taken by digital cameras:• JPEG• RAW – Canon, Sony, Olympus,
Nikon etc.• Adobe DNG • TIFF
• Also recovers:• PNG• GIF• BMP
Photo Forensic Case StagesEvidence Acquisition Photo Recovery Organization Content Analysis
Photo Details
Adult
Obscenity
CP
Nudity
Classification/CategorizationVerify IntegrityReporting and Exporting
Organization• APF allows faster organization
and processing of cases involving photos• Traditional forensic applications
are focused on text and files.• APF has a dedicated and
streamlined UI for photos.• Forensic Photo Gallery provides
the fastest and most powerful way to view and organize photos.
• Sort/Group/Filter based on important photo specific properties
Organization – Forensic Photo Gallery
• APF has a unique and powerful forensic photo gallery:• Identify with one click
• Cameras used • Image Manipulation Software (ex.
Photoshop)• EXIF Date/Times (Day, Month or Year)• File name, folder and much much more
• Filter Photos• By Photo Format• Resolution (include/exclude thumbnails etc.)• Ignore Status
Photo Gallery – Camera Grouping
Grouping By Camera
Filtering out thumbnails
(4 Photos)Apple iPhone 4
(2 Photos)Nikon D100
Category
User selected
! Hash Alert
Bookmarked
Possible actions for selected photos
Custom Gallery• APF contains a custom gallery:
• View and sort user selected pictures.
• View and sort location or type specific photos like:• Windows Thumbnail Cache• Recycle Bin/Trashes• Extension Mismatch• Hash Alerts• Bookmarks• Ignored
Photo Forensic Case StagesEvidence Acquisition Photo Recovery Organization Content Analysis
Photo Details
Adult
Obscenity
CP
Nudity
Classification/CategorizationVerify IntegrityReporting and Exporting
Content Analysis• There can be hundreds of thousands of
photos in a single disk image.• Analyzing them manually is just not efficient.• Viewing photos by their thumbnails can still
take a huge amount of time.• Thumbnails are subject to anti-forensic
attacks.• So how do we save time and show an
examiner only forensically important photos?• SmartFiltering™
SmartFiltering™• SmartFilters™ present the most
forensically relevant photos:• Explicit Image Detection (Fast/Best)• Face Detection• Thumbnail Mismatch• SmartHash™• MD5 Hash Alerts• SmartHash™ Alerts
Explicit Image Detection• 2 Modes of EID• Best for detailed analysis• Fast for triage (does not slow down recovery)
• Experimental Child Explicit Image Detector included• Dynamic slider for reducing or increasing explicit images
shown.• Sort by skin percentage• EID uses much more than skin analysis to reduce false
positives and false negatives
Thumbnail Mismatch• Criminals know that investigators maybe
reviewing evidence via thumbnails.• Investigators rarely have the time to
view each photo in full detail.• Illicit images can be hidden behind
“safe” thumbnails!• Easy to do• Manually• Photo applications like Photoshop
• Thumbnail Mismatch identifies those photos where the full image does not match with it’s thumbnail
MD5 Hash Alerts, SmartHashing™• Finding known illicit images, examiners normally use MD5 hashes• APF has full support for MD5 hash alerts
• But what if the photo is slightly changed?• MD5 Hash will not work.
• APF incorporates SmartHashing™ that finds photos even if:• Resized• Color changed• Brightness changed• Slightly Cropped/Rotated• Touched up/Logo Insertion/Logo Removal
Photo Forensic Case StagesEvidence Acquisition Photo Recovery Organization Content Analysis
Photo Details
Adult
Obscenity
CP
Nudity
Classification/CategorizationVerify IntegrityReporting and Exporting
Photo Details• APF has the most
powerful forensic photo viewer on the market:• Full Image• Preview/Thumbnail
Images• Photo Header Details• EXIF Metadata• File System Information• Categorization &
Bookmark Info• Summary• Cluster/Fragment
Linking
Photo Details - Timelines• Generate zoomable time
lines based on• File Access Dates• File Creation Dates• File Modification Dates• EXIF Date/Time
• Use EXIF Date/Times to get date time information even if files are deleted.
• Filter based on dates
Photo Forensic Case StagesEvidence Acquisition Photo Recovery Organization Content Analysis
Photo Details
Adult
Obscenity
CP
Nudity
Classification/CategorizationVerify IntegrityReporting and Exporting
Classification/Categorization• Categorization is an important part of a forensic analyst’s work.• APF categorization was built from the ground up to be FAST and
powerful.• APF includes built-in category profiles• UK CP• North American CP
• APF allows creation of custom profiles.• Create rules to automatically categorize based on SmartFilters™• Use hot keys to efficiently categorize from any screen.• Use categories to view/report/export/save/timeline photos.
AdultPlay
CPNudity
Categorization Flow
Recovered Photo
MD5 DB Check SmartHash DB Check
EID Rules Check
Lookup Lookup
AdultOther CP Nudity
Categorize
Match
MatchManual
Photo Forensic Case StagesEvidence Acquisition Photo Recovery Organization Content Analysis
Photo Details
Adult
Obscenity
CP
Nudity
Classification/CategorizationVerify IntegrityReporting and Exporting
Verify Integrity• Full Viewable Logs• Generate
MD5/SHA1/SHA256 hashes of photos
• Do MD5/SHA1/SHA256 hashes of evidence before and after recovery
• Compare evidence hashes prior to recovery against current hashes and stored hashes (Encase Only)
Photo Forensic Case StagesEvidence Acquisition Photo Recovery Organization Content Analysis
Photo Details
Adult
Obscenity
CP
Nudity
Classification/CategorizationVerify IntegrityReporting and Exporting
Reporting and Exporting• Customizable reports• File System Data• Photo Details• EXIF Details• Thumbnails
• CSV Exporting• File System Data• Photo Details• EXIF Details• Thumbnails
• FTK KFF Exporting
Additional Features• Batch Analysis for running multiple
cases over night or over the weekend• Ability to quickly blur thumbnails to
prevent others from viewing photos.• Full hotkey support for all major
features.• Built-in context sensitive help• Certified Adroit Forensic Examiner
(CAFE) training available
ADROIT PHOTO FORENSICS
Contact Digital Assembly or an authorized reseller to provide you with a demo or additional information.
Website: http://digital-assembly.comEmail: [email protected]: 212-292-3136