Reducing Computer Evidence Processing Backlogs

by Michael R. Anderson

NTA Stealth™ is a lead generation tool programmed to identify thousands of known pornographic Web sites that may have been downloaded to a computer even when the computer user believes that he or she has eliminated the information by deleting it or by reformatting the hard drive.

Personal computers have become an important part of society. One of the benefits resulting from personal computers is the wealth of information that can be obtained over the Internet and the ease of communications via e-mail. However, law enforcement agencies must deal with the “dark side” of the Internet - the worldwide distribution of pornography, particularly the illegal distribution of child pornography. As a result of the proliferation of child pornography over the Internet, computer evidence processing backlogs are commonplace in most law enforcement computer forensics units. These backlogs just seem to get worse as hard disk drive storage capacities grow.

Armor Forensics has developed a computer forensics/sampling tool designed to reduce the computer evidence processing backlogs of law enforcement computer forensics crime units. The tool is called NTA Stealth™ and it can quickly determine if a seized computer has been involved in past pornography-related internet activities. This patented forensic tool was developed by New Technologies, Inc. (NTI), a company owned by Armor Forensics. It can help computer forensics examiners prioritize examinations. It is also a lead generation tool programmed to identify thousands of known pornographic Web sites that may have been downloaded to a computer even when the computer user believes that he or she has eliminated the information by deleting it or by reformatting the hard drive. As NTA Stealth™ is processing a computer, it keeps a running count of leads it has identified as either known pornographic Web sites or as possible pornographic sites. If nothing is found from running NTA Stealth™ on a computer, then the processing of that computer can be moved to a lower priority.

NTA Stealth™ is easy to use and can be executed from a floppy diskette or, in the case of computers without floppy drives, from a USB thumb drive. All the user has to do is insert a pre-configured floppy disk into the target computer’s floppy drive and NTA Stealth™ automatically processes the computer’s hard drive for possible pornographic activity. If there is no floppy drive in the target computer, NTA Stealth™ will automatically process the hard drive through the insertion of a boot CD and a pre-configured USB thumb drive.

NTA Stealth™ does not modify any evidence and, when artifacts of past adult and child porn web browsing activities are identified, the information is documented for further investigation.

NTA Stealth™ comes with an easy-to-use analysis tool called NTA Viewer that helps law enforcement computer forensic units quickly analyze leads generated by NTA Stealth™. If the analysis computer is connected to the Internet, NTA Viewer allows the user to quickly view the suspected Web site on the Internet through the simple click of the mouse in order to validate leads identified by NTA Stealth™.

This unique product has been priced to fit limited law enforcement budgets and is continually updated by NTI to keep pace with the child porn marketers who try to stay one step ahead of law enforcement agencies. The logic upgrades can be downloaded from the Internet free-of-charge by licensed users of NTA Stealth™ technology. Information about NTA Stealth™ can be found on the Internet at http://www.forensics-intl.com/nta.html. NTI also provides telephone technical support to law enforcement agencies, at no additional charge.

Unlike some computer forensics tools, NTA Stealth™ is not restricted by the use of software dongles and one licensed copy can be used on several evidence computers at the same time. NTI has developed several pre-processing tools to aid in the reduction of computer evidence processing backlogs and NTA Stealth™ was specifically designed for computer-related investigations involving child pornography.

If your agency has a computer forensics unit, NTA Stealth™ will help reduce computer evidence processing backlogs when the cases involve the illegal distribution of child pornography.

Questions about NTA Stealth™ should be directed to NTI at (503) 661-6912 or via the Internet at info@forensics-intl.com. More information on NTA Stealth™ is available at http://www.forensics-intl.com/nta.html.