diligere / windows-forensics Goto Github PK

Crimes involving ICT devices have grown manifold in the recent years. With the readily available tutorials and COTS hardware, cyber criminals are pulling off sophisticated attacks. Also, various crimes have one or another digital devices associated with the crime scene posing huge technical challenge to the Law Enforcement Agencies. Ironically, the LEAs could not keep up with the pace of development of cyber crimes due to legal, logistical and HR constraints. Through the Project LAWFAT, we hope to address certain issues plaguing the investigators:-

1. LAWFAT reports would be applicable in the Court of Law. The HDD imaging will be done through established tools like FTK Imager and the analysis will be performed using LAWFAT on those images thereby maintaining the integrity of the evidence.

2. LAWFAT is planned to be developed in Python as a Open Source Project leading to huge savings on the exchequer as compared to the commercial Forensic Workstations. LEAs can use the normal PCs for analysis and need not depend on expensive Workstations, as the heavy lifting is done by the LAWFAT Servers. This not-so-complex Client-Server architecture will result in less downtime, high availability and reduced expenditure. LEAs could also be trained to add custom features to facilitate in investigation.

3. LAWFAT is a Web-based Tool and will provide freedom to the analysts. Presently, the analysts have to sit glued to the Forensic Workstations and are confined to their workplace. In contrast, LAWFAT allows access to the authorised personnel from literally anywhere.

4. LAWFAT enables collaboration by teaming up analysts from geographically dispersed Forensic Labs . The collective wisdom from the experts from various labs will help in faster resolution of cases.

5. LAWFAT features VPN access for security of information, Authorisation mechanism for ensuring access by only authorised personnel, Accounting functionality.

Some of the key objectives of LAWFAT are as follows:-

1. LAWFAT reports would be applicable in the Court of Law.

2. LAWFAT saves huge sums of money to the exchequer as it is being developed in Python as a Open Source project and does not require expensive forensic workstations.

3. LAWFAT is based on Client-Server technology making it convenient for the analysts to work from anywhere and any device.

4. LAWFAT enables collaboration by analysts from different labs for faster resolution of cases.

5. LAWFAT features various security and performance monitoring measures viz., authentication, authorisation, accounting, VPN access etc.

The idea to jumpstart LAWFAT originated during a casual conversation among the following team members. Though the start is casual, the awesome @dreamoryindia and @diligere are more than committed to take it forward.

• S Raja Prabhu (Twitter: @inf0knight)
• Kajol Nirav Patel (Twitter: @dreamoryindia)
• Manishjeet Nayak (Twitter: @diligere)

1. LAWFAT is planned to be developed in Python as a Open Source Project leading to huge savings on the organisation as compared to the commercial Forensic Workstations. LEAs can use the normal PCs for analysis and need not depend on expensive Workstations, as the heavy lifting is done by the LAWFAT Servers. This not-so-complex Client-Server architecture will result in less downtime, high availability and reduced expenditure. LEAs could also be trained to add custom features to facilitate in investigation.

2. LAWFAT is a Web-based Tool and will provide freedom to the analysts. Presently, the analysts have to sit glued to the Forensic Workstations and are confined to their workplace. In contrast, LAWFAT allows access to the authorised personnel from literally anywhere.

3. LAWFAT enables collaboration by teaming up analysts from geographically dispersed Forensic Labs . The collective wisdom from the experts from various labs will help in faster resolution of cases.