Although you are, of course, correct about evidence either being present or not, from a defense angle (and I’ll admit I never do defense work so my opinion is conjecture) it would be hard to argue flaws in the software or false positives if you cannot test it for yourself.

I guess I would have to disagree about the Law Enforcement have limited funds. As long as they know how to write they can potentially get grants to supplement quite a bit of things that they may want or need (at least in the US). A police Department that is not to far from where I live just received over 400,000 over a 2 year time period to start a forensic program and train officers. Now that is quite a bit of cash and I wish someone would hand that money to me and tell me I did not have to pay that back.

Now about your statement about Law Enforcement developing something and the private sector stealing it and making a profit. where did they get the money to develop this? They are public employees getting paid by the public so I cannot see how your argument holds water. If it was not for the public funds that are paid then Law Enforcement would not have developed them. Now if they are afraid that someone will take it and sell it then do not provide source code for it just the program, that is what I do. You also have to remember it costs money to develop/produce/support and market software, even if someone has come up with the program. This means that it had better be a great product and expensive to get their monies out of it they have put in to launch it.

Now for the statement about Free tools. iLook was free to Law Enforcement and if person using the product reports something but and we do not find it with our tool do you not think we (as private contractors) should have to opportunity to vet iLook and see if it is working correctly. Maybe it is not and we can then have the opportunity to help with a bug in the software. For other LEO only tools there is a version of Liveview the is LEO only and also what about Cofee.

Now for the crack about fixed budgets, Law Enforcement agencies do not have to worry about Errors and Omission Insurance, Marketing, property taxes and other aspects a business owner has to deal with. Now for Law Enforcement to be entitled to anything is ridiculous, nobody should be entitled to anything.

Just my .03 cents

Digital evidence is either there or it’s not. It’s irrelevant how the data was obtained, or what tools were used to illuminate it.

With reference to the Law Enforcement only conference in relation to mobile phones it seems to me that the organizer’s wanted to keep some information in house and not share it with the wider community. I cannot speak for the organizer’s, but their approach might be as a result of persons in the private sector taking advantage of research and then gaining a commercial advantage from it by developing paid for software.

It is not necessarily the case that the techniques discussed will become open knowledge. If I as Law Enforcement develop lets say, a parser that speeds up the decoding of something you are still able to decode manually and achieve the same results.

Likewise free tools such as iLook only duplicate functionality available to you with paid for tools. What LE only tool are you alluding to that produces results that cannot be independently verified?

With regard to reduced pricing for Law Enforcement you fail to acknowledge the most obvious difference. Law Enforcement agencies are public bodies with fixed budgets funded by taxation. During the course of a year it is not possible to raise more capital and most significantly (with limited exceptions) they do not charge their customers for the work carried out. Private companies are able to disburse their costs onto their customers. Software providers recognize this difference and from a marketing perspective reduce their prices accordingly. Additionally the sheer scale of Law Enforcement entitles them to a significant volume discount.

Forensics is not some big secret that needs to be hidden from civilians.

In fact, at least basic forensics and evidence collection should be made a part of the A+ or Microsoft certifications. I have worked for dozens of client’s in non-forensics roles. None have had a policy in place for simple things like “a tech finds CP on a company computer” or “a suspected employee locked his machine, what do we do now.”

I think some of the reason is that the developers are former cops, so they want to keep some of the ‘game’ within the LE community. Also, they get to charge more for software if it has some cachet of being for LE use only.

Where is next episode!!!!

Now no matter what tool is used the results should be reproducible, if the report is written correctly (which I have seen a lot of crappy reports from LE’s, and they should have to take some free classes for report writing, and I have also seen some crappy reports from private sector examiners as well) then it should not matter what tool is used. If the results are not reproducible and they used a specific tool available to “LE” only then we should have access to that tool to verify there results that we can not reproduce. The court should not allow this but it should be the examiner for the defense that challenges this and shows the court proof that the “LE” software shows something other software does not.

Just my .02