Forensic Software in Child Protection Cases

According to recently released statistics from ICAC, an agency whose aim is to make the internet safer for children, only 2% of reported child protection cases are investigated in the United States each year. Often the media seize every opportunity to disparage forensics organisations, child protection charities and law enforcement agencies for not coming up with more effective solutions to these cases, but the reality is that the investigation of illicit image distribution is a wide-ranging and complex area, fraught with difficulties.

Digital forensics professionals will undoubtedly come across such cases as part of their general workload. Sometimes a case will begin with an investigator specifically looking for suspicious images, whilst at other times the illicit nature of the images will be discovered in the course of an unrelated process. Regardless of the initial push, however, it is undoubtedly one of the most taxing and time-consuming parts of the job.

Internet Watch Foundation – on the frontline

The Internet Watch Foundation in the UK understands the issues around child protection investigation better than most. The IWF fields reports from the public about illicit imagery around the internet, and has been dealing with potentially criminal internet content since 1997. The organisation receives around forty thousand submissions per year, and manages to deal with around ten thousand of these.streaming-ones-and-zeros

The psychological repercussions of constantly viewing indecent images of children are not to be overlooked. Most of the cases submitted to the IWF involve more than one image, and the vast majority of content is recycled, popping up over and over again in multiple searches. There is perhaps a sense of becoming, if not immune, at least detached over time, purely to be able to deal with the type of content that must be viewed on a daily basis. A quick scan through any forensics forum will verify that many investigators find it ‘wears them down’ over time, and the need for some form of on the job counselling is widely discussed.


Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

Recognising this, the IWF provides counselling sessions once a month for all employees who deal with child protection issues directly, and indeed frequent counselling seems to be standard procedure in many investigative and law enforcement agencies who regularly come across such content.

But it is not only the psychological challenges that create difficulties when dealing with child protection. The sheer volume of images to analyse, the often wide-ranging nature of the perpetrators, and the difficulty of actually identifying victims means that many such cases go unsolved.

Resource challenges

Investigators frequently have to wade through a huge number of images just to understand whether any inappropriate content is actually being consumed. This means that often, forensic organisations simply do not have the man power to scrutinise every file, analysing it for indecency of content, similarities with other cases, profiling of victims, and so on. We caught up with Ken Mizota from Guidance Software and asked what the main resource challenges are when dealing with child exploitation cases.

“Resources to investigate child exploitation cases are quite scarce relative to the volume of material to review”, Mizota remarks. “ We’ve learned from our customers doing live casework that child pornographers are quick to adopt and utilize new technology. If a child pornographer can add to their collection because the storage technology is more affordable, they will. If technology makes it easier to create or publish more child pornography, they will readily use it. As a result, even small cases easily contain hundreds of thousands of images. Not all images are evidence of child exploitation, but buried in the thousands of images, there may be a victim who needs help.”

Forensic software solutions

So what can be done? Unfortunately there is no one-size-fits-all solution. But there are some pieces of software available that can make scanning images easier, which ultimately reduces the size of each caseload from an entire hard drive’s worth of content down to a handful of images that have been marked as potentially relevant. Investigators can then scan through these for illicit content and ultimately decide whether to continue with the line of enquiry.

Companies such as Guidance Software and AccessData are constantly working to improve on these issues from a technological angle. Currently available packages such as EnCase, Image Analyzer and Forensic Toolkit (FTK) will scan a hard drive for images that appear to contain bare skin, for example, and bring back a number of results for an investigator to look into further. Mizota elaborates on the role of software in alleviating the consumption of pictures of child abuse:

“Digital investigation tools can help to not only expose important evidence, but focus the investigator’s precious energies on understanding the data. Sophisticated data recovery, file carving and signature-based detection expose evidence and categorize known content.

In contrast, a signature-based approach can only eliminate known content. Known content means previously identified exploitative material (e.g. images). Law enforcement agencies like DHS and FBI and even Interpol maintain libraries of hashes of previously identified child pornography. This helps them identify material that is being traded/collected.

So, what about the unknown or new? Digital investigation technologies are available that perform analysis of pornographic materials themselves, and do so faster and more efficiently than ever before. Technologies like EnCase, working together with Image Analyzer, focus the investigator’s effort on the most relevant data, to not only make a case, but shed light on unknown victims.”

And what does the future hold for this area of digital forensics? “I think it is safe to say that advances in technology and communications have outpaced investigative capabilities, factoring in tooling and resources. The percentage of cases that can be investigated promptly is increasing, but the volume marches on steadily. Increasing percentages is positive, but as volume grows, the gross amount of unsolved cases or unknown victims also grows.

The success or failure of child exploitation investigations within digital forensics hinges on cooperation and collaboration. Child exploitation is fostered by technology and also crosses borders and all walks of life. The only rational way to solve such problems is by working together across technologies (from hard disk investigation tools, to image and video analysis, to mobile device forensics) and organizations.

First, and I think foremost, there are initiatives underway within law enforcement communities to share information, collaborate on best practices and techniques, and work together in substantive, scalable ways, across municipalities, states, and even countries. These victim identification initiatives bear the promise of increasing the collective knowledge and expertise of child exploitation investigators. Second, organizations like Guidance Software that build technology, will recognize that through collaboration, and working together, such diverse mutagenic problems can be solved. EnCase and Image Analyzer working together are examples of this approach: Two leading technologies, that both excel at what they do, collaborating to make the work of investigators less laborious and more productive.”

A growing problem

Just how large a problem is the sharing of indecent images of children in the modern age, though? A recent article from the BBC notes that the consumption of pictures of child abuse is at an all-time high. Peter Davies, the director of the Child Exploitation and Online Protection Centre (CEOP), estimates that around fifty thousand people in the UK alone will possess indecent images of children this year, and that 81% of the children featured will be under the age of ten. In the USA, PROTECT’s latest figures show that 300,000 people are trading indecent images of children at any one moment.

Sobering statistics indeed. And according to those who work in the field, the problem only seems to be growing, thus making it even more important for new forensics software packages to take indecent image analysis into consideration. Of course, no piece of software is infallible, and it is possible for files to be missed during a search, but this could just as easily happen with human error, and at least the option of not searching an entire hard drive manually is now open to investigators in digital forensics cases.

Leave a Comment

Latest Videos

In this episode of the Forensic Focus podcast, Si and Desi explore how artificial intelligence is being leveraged to uncover crucial evidence in investigations involving child sexual abuse material (CSAM) and examine the importance of exercising caution when implementing these tools. 

They also discuss a recent murder case in which cyber experts played a vital role in securing a conviction, and explore the unique challenges associated with using digital evidence as an alibi.

Show Notes:

A Practitioner Survey Exploring the Value of Forensic Tools, AI, Filtering, & Safer Presentation for Investigating Child Sexual Abuse Material (CSAM) - https://dfrws.org/wp-content/uploads/2019/06/2019_USA_paper-a_practitioner_survey_exploring_the_value_of_forensic_tools_ai_filtering_safer_presentation_for_investigating_child_sexual_abuse_material_csam.pdf

Man charged with NI murder ‘faked live stream to provide alibi’ (The Guardian) - https://www.theguardian.com/uk-news/2023/feb/02/man-charged-with-ni-faked-live-stream-to-provide-alibi

A YouTuber accused of murder faked a 6-hour livestream to produce an alibi (Sportskeeda) - https://www.sportskeeda.com/esports/news-a-youtuber-accused-murder-faked-6-hour-livestream-produce-alibi

European Interdisciplinary Cybersecurity Conference (EICC) 2023 - https://www.forensicfocus.com/event/european-interdisciplinary-cybersecurity-conference-eicc-2023/#more-493234

YouTuber reportedly faked GTA livestream to have an alibi while he committed murder (Dexerto) - https://www.dexerto.com/entertainment/youtuber-reportedly-faked-gta-livestream-to-have-an-alibi-while-he-committed-murder-2052974/

Forensic Europe Expo - https://www.forensicfocus.com/event/forensic-europe-expo/#more-493225

In this episode of the Forensic Focus podcast, Si and Desi explore how artificial intelligence is being leveraged to uncover crucial evidence in investigations involving child sexual abuse material (CSAM) and examine the importance of exercising caution when implementing these tools.

They also discuss a recent murder case in which cyber experts played a vital role in securing a conviction, and explore the unique challenges associated with using digital evidence as an alibi.

Show Notes:

A Practitioner Survey Exploring the Value of Forensic Tools, AI, Filtering, & Safer Presentation for Investigating Child Sexual Abuse Material (CSAM) - https://dfrws.org/wp-content/uploads/2019/06/2019_USA_paper-a_practitioner_survey_exploring_the_value_of_forensic_tools_ai_filtering_safer_presentation_for_investigating_child_sexual_abuse_material_csam.pdf

Man charged with NI murder ‘faked live stream to provide alibi’ (The Guardian) - https://www.theguardian.com/uk-news/2023/feb/02/man-charged-with-ni-faked-live-stream-to-provide-alibi

A YouTuber accused of murder faked a 6-hour livestream to produce an alibi (Sportskeeda) - https://www.sportskeeda.com/esports/news-a-youtuber-accused-murder-faked-6-hour-livestream-produce-alibi

European Interdisciplinary Cybersecurity Conference (EICC) 2023 - https://www.forensicfocus.com/event/european-interdisciplinary-cybersecurity-conference-eicc-2023/#more-493234

YouTuber reportedly faked GTA livestream to have an alibi while he committed murder (Dexerto) - https://www.dexerto.com/entertainment/youtuber-reportedly-faked-gta-livestream-to-have-an-alibi-while-he-committed-murder-2052974/

Forensic Europe Expo - https://www.forensicfocus.com/event/forensic-europe-expo/#more-493225

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_7QiFTiuY7Vw

AI In CSAM Investigations And The Role Of Digital Evidence In Criminal Cases

Forensic Focus 22nd March 2023 12:44 pm

Throughout the past few years, the way employees communicate with each other has changed forever.<br /><br />69% of employees note that the number of business applications they use at work has increased during the pandemic.<br /><br />Desk phones, LAN lines and even VOIP have become technologies of the past workplace environment as employees turn to cloud applications on their computers and phones to collaborate with each other in today’s workplace environment.<br /><br />Whether it’s conversations in Teams, file uploads in Slack chats, or confidential documents stored in Office 365, the amount of data stored and where it is stored, is growing quicker than IT and systems administrators can keep up with.<br /><br />Corporate investigators and eDiscovery professionals need to seamlessly collect relevant data from cloud sources and accelerate the time to investigative and discovery review.<br /><br />With the latest in Cellebrite’s remote collection suite of capabilities, investigators and legal professionals can benefit from secure collection with targeted capabilities for the most used workplace applications.<br /><br />Join Monica Harris, Product Business Manager, as she showcases how investigators can:<br /><br />- Manage multiple cloud collections through a web interface<br />- Cull data prior to collection to save time and money by gaining these valuable insights of the data available<br />- Collect data from the fastest growing cloud collaboration applications like Office365, Google Workspace, Slack and Box<br />- Login to a single source for workplace app collection without logging into every app and pulling data from multiple sources for every employee<br />- Utilize a single unified collection workflow for computer, mobile and workplace cloud applications without the need to purchase multiple tools for different types of collections – a solution unique to Cellebrite’s enterprise solution capabilities

Throughout the past few years, the way employees communicate with each other has changed forever.

69% of employees note that the number of business applications they use at work has increased during the pandemic.

Desk phones, LAN lines and even VOIP have become technologies of the past workplace environment as employees turn to cloud applications on their computers and phones to collaborate with each other in today’s workplace environment.

Whether it’s conversations in Teams, file uploads in Slack chats, or confidential documents stored in Office 365, the amount of data stored and where it is stored, is growing quicker than IT and systems administrators can keep up with.

Corporate investigators and eDiscovery professionals need to seamlessly collect relevant data from cloud sources and accelerate the time to investigative and discovery review.

With the latest in Cellebrite’s remote collection suite of capabilities, investigators and legal professionals can benefit from secure collection with targeted capabilities for the most used workplace applications.

Join Monica Harris, Product Business Manager, as she showcases how investigators can:

- Manage multiple cloud collections through a web interface
- Cull data prior to collection to save time and money by gaining these valuable insights of the data available
- Collect data from the fastest growing cloud collaboration applications like Office365, Google Workspace, Slack and Box
- Login to a single source for workplace app collection without logging into every app and pulling data from multiple sources for every employee
- Utilize a single unified collection workflow for computer, mobile and workplace cloud applications without the need to purchase multiple tools for different types of collections – a solution unique to Cellebrite’s enterprise solution capabilities

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_g6nTjfEMnsA

Tips And Tricks Data Collection For Cloud Workplace Applications

Forensic Focus 20th March 2023 12:00 pm

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feed settings page to add an API key after following these instructions.

Latest Articles

Share to...