More than a decade ago, writes PAUL VELLA of Evidence Matters Ltd, I overheard a customer in a computer store ask for reassurance from the clerk that his new computer would not become obsolete in the following year.
“Sir,” the clerk replied, “if it’s in stock, it already is obsolete.”
The above comment highlights the difficulties in the computer industry, and more particularly for those investigating computer crime. In 1997, shortly after we founded Evidence Matters Ltd, we charted the size of the computer hard drives we were examining and discovered that we were typically encountering one and two gigabyte hard drives. Today, slightly more than a decade later, the average hard drive we examine is often 400-500 gigabytes in size; and with one terabyte drives costing just £65 at the time of writing we can expect computers seized by the police to contain larger and larger hard drives.
This increase in capacity has had an effect on computer forensics, although it was not the effect I predicted a decade ago. The time taken to process and examine a computer hard drive has increased, but not to the extent that it is impossible. What have improved are the techniques used to search for and filter information; although the use of many pre-written scripts available to the forensic examiner has made it much easier for the inexperienced practitioner to produce reports and sound knowledgeable without actually understanding what is going on under the ‘hood’ of the computer.
As we march into 2009 we can expect to see new technologies and devices coming to market which will eventually land on the desk of a forensic examiner; already the iPod is a regular fixture in many forensic laboratories, but we will expect to see more devices storing data in RFID chips in the future. New display panel technologies will make computers even more portable, and the rise in the inexpensive ‘netbook’ has made laptop computers so cheap they are almost disposable. These days almost every car has a satellite navigation device, which in some circumstances can record the movement and speed of vehicles, and teenagers freely exchange personal information with the world on Facebook and MySpace, with no consideration toward privacy, let alone what details about them future employers might find on the internet.
Much has been spoken of ‘cloud computing’ in recent years, where data and even operating systems and applications are stored not on your computer, but on a server or servers elsewhere. The rise of cloud computing will undoubtedly result in jurisdictional difficulties where data crucial to a case is stored outside the UK. It is for our governments to make arrangements for the immediate preservation of suspect data following a request from law enforcement, to ensure that the data does not disappear while a court decides whether or not the data can be released to UK law enforcement.
Today the computer forensics professional is seen as something of a jack-of-all-trades. I have no doubt that before long practitioners will specialise in certain technical areas which will make selecting the correct expert for your case more difficult, lest the inadequacies of your chosen expert are not discovered until you appear in court.
Companies providing forensic computing facilities should already be preparing for this inevitability if they haven’t done so already.
The next few years will bring us breakthrough technology built around Hewlett Packard’s ‘memristor’, the fabled fourth element in electronics theorised in 1971 (the other three being the resistor, inductor and capacitor) and almost written off as a mathematical dalliance. To say that the discovery of the memristor paves the way for computers to work smarter and faster would be an understatement; the team working on this technology has stated: “A memory based on memristors could be 1,000 times faster than magnetic disks and use much less power.”
They have the potential to revolutionise computing completely over the next decade; however, I suspect that, for the most part, all this new technology will always be obsolete as soon as we get it out of the box.