Exploits, Tools & Data Recovery · The Forensic Tool Landscape · Lesson 5 of 5

Challenge: The Tool Budget

Advise a new county lab on buying, testing and defending its forensic tools.

The shopping list

A county is opening its first digital forensics lab, and you've been hired as an adviser. The lab manager has budget for one commercial suite and wants to fill the gaps with free tools. Her draft plan says:

• 1. Buy one commercial suite to acquire and decode phones, and keep its license current.
• 2. Use iLEAPP to get into locked iPhones that the commercial suite can't open.
• 3. Use Autopsy for computer evidence and as a second place to view phone data.
• 4. Before buying, read the published NIST CFTT test reports for the suite's current version.

She also notes that the county's corporate partner, a private IT contractor, would like to buy its own copy of Graykey for internal investigations.

She asks you to flag anything that's wrong before the plan goes to the county board.

Read or unread

Six months in, a harassment case turns on one question: did the suspect read a threatening message before replying? The lab's suite shows the message as read.

While checking the tool's history, you find a CFTT report on an older version of the same product that listed an anomaly: unread messages were shown as read. Nobody knows whether the lab's current version behaves the same way, and the vendor's release notes don't mention it.

The defense motion

The case goes to trial. The defense files a motion citing a 2021 blog post by Signal's creator. It argues that the lab's suite could have been compromised by a crafted file on the suspect's phone, so every report the machine produced is unreliable. The prosecutor asks you what, exactly, the post said was missing from the vendor's software that made such an attack possible.

The council's question

After the trial, a county council member reads about the Serbia case and asks you a direct question. The vendor the lab uses says it vets customers, doesn't sell to sanctioned countries and has stopped selling in dozens of others. Doesn't that mean misuse can't happen with the county's tools?

She also wants to know whether the county should add any rules of its own, or whether the vendor's license terms already cover it.