WHEN a suspect is apprehended, their computers, phones and other devices become important sources of evidence. But mining all that data 鈥� a typical case can involve several terabytes of information 鈥� takes time, and usually requires specially trained officers. Backlogs can delay investigations for weeks.
Not for much longer. A software package will soon be able to provide a list of a suspect鈥檚 contacts, ranked in order of closeness, in a matter of hours. It works by searching and correlating the contact data in each of a person鈥檚 devices. And with a simple browser-like interface, it is designed to be easy enough for any police officer to use.
Developed by Maurice van Keulen at the University of Twente in Enschede, the Netherlands, and colleagues, in conjunction with computer security firm Fox-IT of Delft, the identity extraction algorithm works as an add-on to a forensics package called Tracks Inspector.
Advertisement
It employs a range of strategies, from identifying contacts by spotting @ signs in Twitter and email addresses to pillaging metadata in document files for the ID of the creators.
It can also piece together complex patterns to work out that different aliases can relate to the same person. 鈥淭he data might mention the same person ten times in different ways,鈥� says van Keulen. 鈥淚t also has to be able to read something like 鈥楶aris Hilton stayed in the Paris Hilton鈥� and infer from the context that one is a person and one is a French hotel.鈥�
Once finished, the software ranks a suspect鈥檚 associates in order of who they contact the most 鈥� and it does it all in minutes to hours, depending on the size of the files seized, says van Keulen.
The system has already proved its worth in an investigation by the Regional Criminal Investigation Service in Arnhem. Five detectives with no special forensics training used the system to investigate a case of human trafficking. Thanks to the identities the software revealed, officers linked the ringleaders to a child pornography operation, says Willem Leeflang, who heads the Tracks Inspector team. The work will be presented in June at the in Rome, Italy.
鈥淭his has the potential to speed up certain investigations,鈥� says Nick Furneaux of digital forensics lab CSITech in Bristol, UK. But he wants to see forensics software go further and embrace gesture recognition.
鈥淔orensic data is very textual and flat. We鈥檙e working on visualising case data graphically so we can explore it via gestures to see stand-out issues that are not obvious,鈥� Furneaux says.
This article appeared in print under the headline 鈥淒igital sleuth finds criminal contacts鈥�
