Paper, pdf, OCR and digital evidence

I've done a short presentation recently about scanned documents and encase while doing my most recent Encase Enterprise Examination training. During practice and discussion we touched issues of scanned documents and paper evidence. By definition paper documents are not part of digital evidence, but their content and metadata can be part of investigation. It is same with picture processing when we have picture of the document. Basically you can read that paper evidence and put it by hand into case, or use some automation to let software to work for you.

The theory is simple, scan paper and process results as digital evidence, in practice plenty of things can be hard, quality of scan is first one comes to mind, than language and alphabet support in OCR software.

ELO http://www.eloweb.eu showing the proces of OCR

Language and alphabet support, localisation,  it is not new issue for digital forensics practice, it was a lot of problems with non latin  character sets and non-english languages since ever. Same is with the OCR, this is actually the most important factor since it is a readability of text recognition. Some software tools are with embedded OCRs as part of forensic package, but sometimes you have use external tool which works better for your choosen language and alphabet.

There are other issues especially ability to automate process, if you have fully automated process it will go faster, with less mistakes and can be reused, as it is for any automated solution. Sometimes it is scripting or using wizards, what depend on the OCR you have.

It is also worth mentioning scanning documents, intuitively it is just putting papers into scanner, but it is not so simple sometimes. It can be a digital camera taking pictures of the book too, whole setup is needed stand, lights, cameras and no forensic equipment. There is one very interesting blog DIY Book Scanning worth of reading especially if your lab is tight on budget.

20.5.2104
very nice paper was posted trough linkedin "Optical Character Recognition" by Irene Ferraz,
gives excellent description of forensics and ORC links.

Digital forensics and unusual documentation sources

During training and discussions of real application of forensic tools we often talk with people who are not police forensics but working in other fields of law enforcement. Digital forensic training is always oriented on tools and digital evidence less on procedures and applications of digital forensic in other areas.

If you are in police or any other first line law enforcement agency you have whole legal and procedural setup how to apply digital forensics, but what if you a from revenue or competition enforcement or auditing ?
It is a big chance to be in situation that you'll have to adopt / apply methods and procedures from other close fields, especially for something relatively new like digital forensics.

During our long trainings in the momnet  when people get hang of the forensic tool and start to think how to use it, I often talk about International Competition Network. http://www.internationalcompetitionnetwork.org/. It is a very good source to look for procedural blueprints and ideas how to incorporate digital forensic into everyday legal work.

I always stress the Anti Cartel Enforcement  Manual as something worth of reading with good thought about. It describes scenario which is applicable to most of non-police organisations with great detail.  After having such source discussed it is much easier to give realistic estimates how and what to do with your forensic tool during real investigation.  There are also some hidden advantages in using International Competition Network, most of the countries already have national  competition enforcement organisation, someone is there who already has been trying to use this suggested procedures in local legal environment.

SlideShare stats for 2013

Just done look into SlideShare stats for 2013, there I link all my presentations to be available online, about 30 various ppts, papers some really outdated, it is a good policy to have all that on one place, not easy to mislaid. Number of hits are not very big but what is interesting is which papers get most attention. 

Higest with about 700 hits is ppt about GPS forenscisc from 2012, a compilation of various sources for EnCase GPS forensics.  Next one with about 600 hits is old presentation about EnCase enterprise integration with IDS/IPS system, and the third one is variation of the second one with about 300 hits.  All other papers are well below that numbers and not even been touched for a long time.

GPS is still interesting issue especially when it is referenced from general purpose tool like EnCase or in combination with specialized mobile forensic tool like UFED, so it is understandable why there are many hits even a year after paper was compiled.

Other two articles a bit of mystery. I'm cheap I haven't activated a full slide-share analytics  so I can't say from where this hits are, but since ppts title are on local language hits  are probably local too. This is a surprising part, since we have only  a handful Enterprise systems around pratically all of them in colds state and almost no interest in enterprise type of forensic tools.