(WARWICKSHIRE, UK)  Mobile phones have always been a rich source of forensic evidence in criminal investigations – but, until now, there has been a level of evidence which investigators have been missing out on.  Developers at CCL-Forensics have taken a major step towards addressing this problem with a technique to interpret and present a phone’s web cache files, showing a subject’s internet history and activity.

Many phone forensic tools may extract these files, but will do little nothing to interpret them or present the investigator with the potentially vital evidence they contain.  CCL-Forensics has created MWCT (Mobile Web Cache Toolkit) which it can use in-house during investigations for police and law enforcement agencies.

It allows the company’s digital analysts to carry out an in-depth investigation into the phone’s usage and enhances the basic information (calls, text messages, deleted data) extracted during a typical forensic analysis.

This valuable data could be deleted – and is often extracted during the acquisition process.  MWCT turns this raw data into useful information – and ultimately into evidence.

The tool also has the additional functionality to present CCL-Forensics’ investigators with loose web cache files which can’t be linked to any web pages, but still contain date and time information, and can provide potentially vital evidence.

An example is shown in a brief web video (which can also be found here).

Phil Ridley, Mobile Phone Lab Manager at CCL-Forensics says: “Phone forensics is about much much more than simply extracting call logs and text messages. 
 
Many devices retain a wealth of information which can be used as part of an investigation – and this data is not difficult to extract. 

It is the interpretation of this data which is crucial.  MWCT presents our analysts with a plethora of potential evidence which they wouldn’t have had access to without this tool.

A suspect’s web history can form a vital part of a prosecution case, as it can reveal their browsing habits and crucially nowadays, social networking activity.  It is inconceivable that an investigator won’t want to know about a suspect’s associations and communications history”

MWCT was developed by the in-house research and development team at CCL-Forensics, the UK’s leading supplier of mobile phone forensics, computer forensics and cell site analysis services to the law enforcement and investigatory community.

For more information, please contact Marketing Manager Andy Holmes on +44 1789 261200 or at aholmes@ccl-forensics.com.  Brief web videos about CCL-Forensics’ research and development projects can be found at http://www.youtube.com/user/cclforensicslimited.

Ends

Bookmark It

CCL-Forensics is again attending the ACPO Cybercrime Conference in Bedfordshire – but this year, the focus is on forensically analysing new and challenging devices like the Apple iPad.

The company’s Forensics Manager, Mark Larson will be on hand with Total Quality Manager David Lattimore, armed with an iPad, a host of smartphones, iPhones, SatNavs and other technologies which are increasingly featuring in forensic examinations.

Alongside this, will be the chance to see interactive demos of the tools and techniques developed by CCL-Forensics to extract crucial evidence from these devices.

It is vital for all investigators to keep abreast of new and emerging technologies, and CCL-Forensics’ R&D experts will be available at the exhibition to share knowledge and best practice on how this can be achieved.

National Telecoms Advisor, Andy Townsend, will also be on hand to discuss the latest developments in Cell Site Analysis and the challenges faces by law enforcement agencies in telecoms analysis. 

For more information, please contact CCL-Forensics on 01789 261200 or email info@ccl-forensics.com

Bookmark It

(WARWICKSHIRE, ENGLAND)  A new software tool has been developed to extract potentially crucial digital evidence from one of the most widely used computer and mobile phone database formats.

The team of researchers at CCL-Forensics have developed and coded “EPILOG” which can prove invaluable in the retrieval of deleted data in SQLite databases, for use in criminal investigations.

SQLite is used extensively in mobile phone and smartphone operating systems (including the Apple iPhone) and in a significant number of web browsers and can contain deleted data which is not visible to the end user.  EPILOG can recover and present this in a forensically sound manner to enhance a range of prosecution cases from indecent images to activity on a range of mobile phones.

The Warwickshire-based company is thought to be the first in the UK to deploy such a tool, and has already been tested it on a variety of mobile phones and computer applications. 

Mark Larson, Forensics Manager at CCL-Forensics says: “Standard forensics tools can only extract SQLite databases from exhibits, and will do nothing to help you interpret their contents.  EPILOG can work with both live and deleted databases, and recover both live and deleted data from them.

This means the amount of potential evidence extracted from a computer of mobile phone is significantly increased, and so is the chance of identifying relevant evidence.
To give an example, we used EPILOG on an Apple iPhone, where it recovered 32 unique deleted call events and five numbers found nowhere else on the phone.  This evidence would not have been recovered without the tool, and could make a difference between success and failure in court”.

A web video explaining more about EPILOG is available here.

EPILOG was developed by the in-house Research and Development team at CCL-Forensics – the UK’s leading supplier of digital forensics services in the UK, working with a number of high-profile police forces and employing more than 80 people.

Bookmark It

The event brought together leading forensic practitioners at the city’s Marriot Hotel to attend seminars on the latest advanced data recovery techniques from the evolving range of smart phones.

It was attended by leading Law Enforcement agencies and Government Security bodies from across the world, and is a valuable forum for sharing knowledge and best practice among leading digital forensics providers.

It benefits CCL-Forensics’ clients by giving the company a deeper understanding of the developing world of mobile phone forensics, and the evidential opportunities which can be explored in more complex phones and applications.

One of the CCL-Forensics analysts who attended said “It was an incredibly useful event, which allowed us to learn valuable techniques and practices from some of the world’s leading lights on mobile phone forensics.

It was a great opportunity to see that our research and development projects complement some of the work being done by world leaders in our field.”

Also under discussion was the validation of tools for use in forensic analysis, which forms the foundation of the ISO17025 standard which CCL-Forensics is already in the advanced stages of attaining. This is required by the Home Office Forensic Science Regulator.

Bookmark It

The article can be viewed here.

Bookmark It

It follows a round of interviews during which the company’s staff were asked about employment practices, training, working environment and other HR issues.

This news gives clients the confidence that the company invests heavily in its greatest asset – its workforce. This is demonstrated by CCL-Forensics’ commitment to training, personal development and R&D.

The news comes just days after the company successfully retained its ISO9001 status following an independent audit.

Bookmark It

The assessor identified no non-conformances during the audit.

This important quality standard demonstrates CCL-Forensics’ commitment to fully auditable and documented procedures across its business. It is important when selecting a supplier to ensure it has ISO9001 in place – AND is regularly assessed by an independent body.

CCL-Forensics also holds ISO27001 certification, and in the stages of becoming accredited to the extensive and stringent ISO17025 standard, which its hoped will be achieved in the coming months.

Bookmark It

Steve Benjamin and Greg Robinson join the company, bringing with them almost 60 years experience in the law enforcement and radio/telecommunications sector.

Steve joined West Midlands Police in the 1970s, before moving in 2004 into the private sector to provide specialist telephony services to law enforcement agencies. Greg Robinson is an RF engineer with more than 20 years experience in the radio and telecommunications industry as an engineer and expert witness.

They join the expanding cell site team which works with law enforcement agencies and legal companies to analyse and map the movement of mobile phones, allegedly involved in crimes or other incidents.

Fore more information about CCL-Forensics’ cell site capability, please contact Andy Townsend by emailing atownsend@ccl-forensics.com or by calling 01789 261200 or 07787 297889.

Bookmark It

CCL-Forensics has made a major investment in its cell site capability, to enhance its range of digital forensic services. The company has recently employed leading cell site expert Andy Townsend, who has ten years of experience and provides these services to a wide range of clients.

Andy joins the team which utilises the very latest in surveying equipment and mapping software to deliver a high-quality, easy-to-understand result – to the timescale demanded by the client.

Andy, who spent 30 years a police officer, is on hand to provide advice and consultancy on cell site assignments, and brings a wealth of experience to the company.

Cell site analysis is the process of geographically locating where a mobile phone has been using data supplied by the mobile phone company, and can be used in a variety of legal cases. For more information, please click here to read more about cell site analysis.

If you would like more information, or for a no obligation discussion, please contact Andy Townsend by emailing atownsend@ccl-forensics.com or by calling 01789 261200 or 07787 297889.

Bookmark It

New technology creates more wide-ranging demand for computer forensics suppliers

A Warwickshire-based computer forensics supplier is leading the way in researching new digital technologies in the fight against crime.  CCL-Forensics, based in Stratford-upon-Avon, is receiving a growing number of enquires about the forensic analysis of new and complex mobile phones and computers – all of which can contain vital digital data which can be used in a wide range of investigations.

As mobile phones become ever more sophisticated, they are essentially developing into small computers – meaning they can hold a wealth of significant data in addition to just contact lists, text messages and call logs.  Because of this, an analysis of these complex phones needs to be tackled more like a computer forensic investigation, than a traditional phone analysis.  Many phones now include applications, and are themselves optimised for “social networking” with Facebook and Myspace applications built in to many models.  This can mean a large amount of accessible data is stored on the phone, which is not interpreted by standard digital forensic tools. 

CCL-Forensics’ Marketing Manager Andy Holmes says “This data, which isn’t deleted, is sometimes accessible by forensics tools – but the added value comes from interpreting and presenting it.  CCL-Forensics has invested considerably in R&D to enable this data to be extracted and presented from an increasing number of phones.”

Other valuable data which can be stored on phones is the custom dictionary list.  When a user enters a word which the phone doesn’t recognise, they are given the option of adding it to the dictionary.  Using tools and techniques developed by CCL-Forensics, these lists can be extracted and presented to the client, giving often useful mens rea (literally “guilty mind”) evidence in a case.  This is a crucial part of a typical computer forensic investigation, and thanks to CCL-Forensics’ advancements in mobile phone forensics, can also be applied to a variety of mobile phone handsets.

It doesn’t have to be a particularly complex phone for this type of evidence to be stored.  Most phones have internet access in one form or another, and therefore can hold this valuable data.  Technology will only continue to advance, and as it does so, the boundaries between computer forensics and mobile phone forensics will become increasingly blurred.  CCL-Forensics will continue to invest in its internal R&D function to ensure it can handle an increasing number of new and more complex devices.  For more information, please call 01789 261200.

CCL-Forensics is a Warwickshire-based computer forensics and mobile phone forensics supplier which has been working with some of the UK’s largest police forces, law enforcement agencies and legal firms since 2002.  More information is available at www.ccl-forensics.com.

Bookmark It