SFP1215W Forensic Pouch E V A L U A T I O N R E P O R T

Transcription

1 E V A L U A T I O N R E P O R T April 2012

2 NIJ Electroic Crime Techology Ceter of Excellece 550 Marshall St., Suite B Phillipsburg, NJ NIJ ECTCOE TESTING AND EVALUATION PROJECT STAFF Robert J. O Leary, CFCE; DFCP Doald Stewart, CFCE; ACE Victor Fay-Wolfe, Ph.D. Russell Yaw, CFCE Rady Becker, CFCE Kriste McCooey, CCE; ACE Chester Hosmer Jacob Foseca Laurie A O Leary Mark Davis, Ph.D. Michael Termielli, ACE

3 Cotets i i i Table of Cotets Itroductio... 1 Overview... 3 Product Iformatio... 3 Special Features... 3 Evaluatio ad Testig of Select Fabricator s... 5 Test Results... 6 Coclusio... 7

4 Itroductio 1 Itroductio T he Natioal Istitute of Justice (NIJ) Electroic Crime Techology Ceter of Excellece (ECTCoE) has bee assiged the resposibility of coductig electroic crime ad digital evidece tool, techology ad traiig testig ad evaluatios i support of the NIJ Research, Developmet, Testig ad Evaluatio (RDT&E) process. The Natioal Istitute of Justice RDT&E process helps esure that NIJ s research portfolios are aliged to best address the techology eeds of the crimial justice commuity. The rigorous process has five phases: Phase I: Determie techology eeds pricipally i partership with the Law Eforcemet ad Correctios Techology Advisory Coucil (LECTAC) ad the appropiate Techology Workig Group (TWG). NIJ idetifies crimial justice practitioers fuctioal requiremets for ew tools ad techologies. (For more iformatio o LECTAC ad the TWGs, visit Phase II: Develop techology program plas to address those eeds. NIJ creates a multiyear research program to address the eeds idetified i Phase I. Oe of the first steps is to determie whether products that meet those eeds curretly exist or whether they must be developed. If a solutio is already available, Phases II ad III are ot ecessary, ad NIJ moves directly to demostratio, testig ad evaluatio i Phase IV. If solutios do ot curretly exist, they are solicited through aual, competitively awarded sciece ad techology solicitatios ad TWG members help review the applicatios. Phase III: Develop solutios. Appropriate solicitatios are developed ad gratees are selected 1 Natioal Istitute of Justice High-Priority Crimial Justice Techology Needs, March 2009 NCJ through a ope, competitive, peer-reviewed process. After grats are awarded, the gratee ad the NIJ program maager the work collaboratively to develop the solutios. Phase IV: Demostrate, test, evaluate ad adopt potetial solutios ito practice. A potetial solutio is tested to determie how well it addresses the iteded fuctioal requiremet. NIJ the works with first-adoptig agecies to facilitate the itroductio of the solutio ito practice. After adoptio, the solutio s impact o practice is evaluated. Durig the testig ad evaluatio process, performace stadards ad guides are developed (as appropriate) to esure safety ad effectiveess; ot all ew solutios will require the publicatio of ew stadards or guides. Phase V: Build capacity ad coduct outreach to esure that the ew tool or techology beefits practitioers. NIJ publishes guides ad stadards ad provides techology assistace to secod adopters. 1 The High Priority Crimial Justice Techology Needs are orgaized ito five fuctioal areas: Protectig the Public. Esurig Officer Safety. Cofirmig the Guilty ad Protectig the Iocet. Improvig the Efficiecy of Justice. Eablig Iformed Decisio-Makig. The NIJ ECTCoE tool, techology ad traiig evaluatio ad testig reports support the NIJ RDT&E process, which addresses high priority eeds for crimial justice techology.

5 Overview 3 Overview The demad for the ability of first respoders ad examiers to coduct field examiatios of mobile devices is icreasig. For mobile devices potetially cotaiig digital evidece, the NIJ Electroic Crime Scee Ivestigatio: A Guide for First Respoders, 2 recommeds: First respoders should also have radio frequecy-shieldig material such as faraday isolatio bags or alumium foil to wrap cell phoes, smart phoes, ad other mobile commui catio devices after they have bee seized. There is a wide selectio of faraday bags available to first respoders. Typically they are made of solid material, makig it difficult or impossible to see the scree of most moder day smart phoes. Depedig o the examiatio tools used by the examier or first respoder, differet meus may eed to be accessed i order to put the device i USB, debuggig or airplae mode. Select Fabricators, Ic. (SFi) has developed a faraday bag called the Foresics Pouch that solves this issue by icludig a clear widow. Product Iformatio The followig is from the Select Fabricators, Ic, website 3 : The patet pedig gives the law eforcemet commuity the meas to secure ad maipulate wireless devices. The USB 2.0 coectio o the iput/output plate allows the coectio of a secured device to a foresics computer i the field or i the lab. SFP1215W with SFi s capacitive sesig techology works with ay portable wireless device icludig smart phoes. Special Features From the product iformatio sheet 4 : The SFP1215W allows for hads-o maipulatio of wireless devices i a RF tight eviromet, makig sure iteral data is ot compromised from momet of capture. 3 SecurityPouch.html Select%20Fabricators%20SFP1215%20 Security%20Pouch.pdf

6 4 Overview There is o eed to take the captured device back to the laboratory to view the iteral memory. The see-through soft material widow ad USB 2.0 coectio allows device maipulatio i the field. SFP1215W is maufactured i the Uited States of SFi s proprietary silver/copper/ickel fabric. This coductive, flexible material is the same fabric used over the past decade to make room sized to table top RF shielded eclosures. Better tha 75 db, percet RF Isolatio from 500MHz to 6.0GHz. 5 Complete kit comes with Operatig Istructios ad Carry Bag. More affordable tha lab-based oportable metal eclosures. Works with ay portable wireless device, icludig smart phoes with SFi s capacitive sesig techology. Coects to ay foresic diagostic software/ computer. Each kit weighs less tha oe poud. 5 The sigal isolatio reported ad the reported frequecy rage was ot tested as this is outside the scope of this report. NLECTC Crimial Justice Electroic Crime Techology Ceter of Excellece

7 Evaluatio ad Testig of 5 Evaluatio ad Testig of Select Fabricator s T he SFi was used i a real-world settig o devices submitted for foresic examiatio. These devices were processed usig the Foresic Pouch oce it was cofirmed that the Foresic Pouch preveted the devices from attachig to a cellular etwork. The followig phoes are a small subset of the devices processed while usig the Foresics Pouch: Apple iphoe 3G (AT&T). Apple iphoe 4 (AT&T). HTC A9292 EVO 4G (Sprit). LG Model CU400 (AT&T). LG Model CU575 (AT&T). LG Model GU295 (AT&T). Motorola A455 Rival (Verizo). Motorola ide Model i465 (Boost Mobile). Samsug Model SGH-A897 Mythic (AT&T). Samsug Model SGH-T105G (TracFoe). Sayo Model SCP2700 (Boost Mobile). Sayo Model SCP6760 (Boost Mobile). Soy Ericsso Model W350a (AT&T). The followig pictures show both a Adroid ad a iphoe through the Foresic Pouch s widow.

8 6 Evaluatio ad Testig of Test Results I every istace, SFi s successfully blocked the device beig examied from attachig to a cellular etwork. While usig examiatio tools that require the device to be attached to a computer or reader of some type, the SFP1215W Foresic Pouch worked as advertised. Each device was successfully processed without the device attachig to the etwork. NLECTC Crimial Justice Electroic Crime Techology Ceter of Excellece

9 Coclusio 7 Coclusio The Select Fabricator SFP1215W Foresic Pouch performed as advertised, blockig cellular coectios o all of the devices processed while usig the Foresics Pouch. The device s scree could be viewed through the soft material widow. The iteral USB coectio i the pouch made it effortless to attach the device to a computer or other type of reader. The Touch Scree Maipulatio Isert made it very easy to access the meus ad submeus eeded to put the device beig examied ito USB, debug or airplae mode. The Foresic Pouch performed exceptioally well i all respects.