Hmmm. I'm hoping that no one believes that make the user an expert witness. This is (I hope) nothing more than a quick look to see if there's need for seizure? Can you share a little when "someone with zero experience" is examining systems?
Great responses guys and nice to see varying opinions in an open debate. I understand what JonN says about the clever ones hiding them further, however at present we arent worrying any of them. Out of the 212 on my patch if we stop a few from further offending it will be a start. The savvy ones are always going to be harder to monitor and for them Covert CII methods will need to be used (however I think its only a small team of about 6 but they are in the metpol)
I guess you are right in that its being used as a stick, but until we can improve the Internet providers responsibilities we have to use the best we have.
Hmmm. I'm hoping that no one believes that make the user an expert witness. This is (I hope) nothing more than a quick look to see if there's need for seizure? Can you share a little when "someone with zero experience" is examining systems?
This is exactly just that ddow. Its simply a way to do an onsite check. In UK law it will be either voluntary (which is open for debate in itself) or when written into sex offender prevention orders. This is new territory for all of us and yet to be challenged in court.
I can stress we will not be considered expert forensic witnesses, however in our unit we CAN expertly grade an image sufficiently to seize for full forensic reports/analysis
Pulpfixtion, thanks for the clarification. The court rulings will be something we all will watch I think.
Its simply a way to do an onsite check
And I think herein lies the problem, it's the same sort of conversation as the one I have often about previewing.
You go to an offenders house and 'view' his computer using one of these disks - you find nothing. Are you happy with that? Does that satisfy the need to check on them?
I'd actually like to know whether anyone who uses this method has gone to someone's house and found anything, I'd be really interested.
Please don't get me wrong, I'm not against any form of checking up on sex offenders, my only concern is the same one expressed above about a false sense of security, and if we put too much faith in a flawed process (and by that I don't mean WHAT you use, but HOW you use it) then it could all go horribly wrong.
Hello Pulpfixtion,
if you are looking for a fast and easy viewer you should take a look at XnView ( http//
I use XnView in a corporate enviroment to scan our data servers, with good results. I know, its not forensically sound, but if you want that you have to make a forensic image. Your question was for a simple application, easy to use and portable.
O, not forgotten to mention that its free.
I would suggest you contact Bill Crane at NPIA (formerly NSLEC at Wyboston) re SPADA training. They were running a one day course on it last year which was attended by many PPO's and HTCU officers.
Stu
I understand fully what you say, however I stick by the fact that if we prevent one more victim, its one less life ruined.
As mentioned in the above quote.. Herts are using this system, thats how i heard from a colleague. I am unsure what other forces are dipping their toes in, but like you.. It will be interesting to see the results.
Also as this is backed by the NPIA & ACPO it seems it will be eventually introduced across the UK?
I understand fully what you say, however I stick by the fact that if we prevent one more victim, its one less life ruined.
As mentioned in the above quote.. Herts are using this system, thats how i heard from a colleague. I am unsure what other forces are dipping their toes in, but like you.. It will be interesting to see the results.
Also as this is backed by the NPIA & ACPO it seems it will be eventually introduced across the UK?
This, as I see it, is the problem. If forces start using SPADA on this basis and NPIA and ACPO support it, where is the impetus for a less-flawed solution to be produced or introduced? There are a number of other projects underway which may prove more suitable. If all you want to do is preview images, even a solution based on Xnview on a thumbdrive would be more effective than the SPADA disk from what I've seen so far.
Have you considered the time it will take to preview all the images from a suspects computer during a visit, let alone reviewing their internet activity, etc?
Very interesting thread as I've been facing thinking about these questions for a few years now …
Is it a good idea to give a "preview" tool to untrained and/or unexperienced collegues.
I can see two risks in that situation
1 - Whatever tool you provide, the results will have to be understood correctly. Computer forensics is such amoving area that I believe only regular practice make you able to understand the real meaning of some findings. Of course, it's only preview and the results will have to be confirmed by a full analysis but …
2 - What happens if the preview is negative ? And what would have happened if no preview had been available ? The risk here is that computers that would otherwise have been analyzed in depth could be "dismissed" since preview was negative.
I guess that, in the end, such a preview is good if it applies only to computers that would not have been examined if preview didn't exist. The collegues who use it must be aware of the limits of the tool and must be trained to react, not only to positive preview, but also to previews showing too little data (I always become very suscpicious if I don't find any track of porn activity on a computer)
Apart from pictures, some other elements can provide a good idea of the use of the computer. Evy is a tool created by a collegue from the Belgian police which extracts useful data from a computer (recent docs, email headers etc…) It's available only to LE but is very handy.
Another nice tool for first responders is Sequoia View. It's a freeware which displays graphically the content of a HDD. With very little experience, it's greta to have a fairly good idea about the general use of a system …
The issues and concerns on this issue are relevant everywhere. In my state we use a number of initiatives;
1. Use Field Search software for non-forensic types (It's free - and while rudimentary in regards to a "true" forensic analysis, it is something and yes we have discovered violations using this tool.)
2. Employ the use of off-site monitoring; you can do it yourself with something like eBlaster or you can hire a private company to do the monitoring for you. In most cases the offender foots the bill and the company hosting this does all the bill collection on their own, even for non-payers.
3. Build into their release conditions to allow the routine and unannounced analysis of all digital media. We go to their homes, remove all equipment and media items and bring it back to the lab for analysis.
4. Offenders are wise, they will begin to learn that if you are checking their stuff they will find other means of procuring their "goods". Displacement is an issue; but can be manageable with good offender tracking.
5. We will not catch every offender. That said, everything you or others do to monitor and track these offenders is a level of deterrence and a matter of public safety. Do nothing and the consequences could be devastating.
6. Keep you courts informed of "supervision" obstacles. They can often add leverage to the conditions that allow us to better monitor and contain the offenders.