All about EVE

Bill Crane is excited. Having worked in the field of digital forensics at the highest levels internationally, he recognises a world leading technical innovation when he sees one.

Left to right: Maarten Kleintjes, Bill Crane and Simon Wellborne pictured with the computer that runs EVE. Photo: Anna Woolnough

Currently Operations Manager for the e-Crime Group, Bill’s credentials include Head of the High Tech Crime Training programme in the UK and Deputy Assistant Inspector General for Investigations, US Deptment of State. He recognises EVE (Environment for Virtualised Evidence) as a huge innovation.

EVE was conceived by Maarten Kleintjes, Manager National e-Crime Group and Simon Wellborne, Forensic Solutions Architect, plus their team of developers in Wellington.

EVE will have a significant impact on the way that electronic evidence is gathered and prepared for prosecution.

Bill says, “As computer technology has evolved the potential for information to be stored on electronic systems has grown exponentially.

“This has caused serious difficulty for digital forensic examiners, who when faced with a complex inquiry, can spend weeks delving into the innermost workings of a computer to find the traces of evidence required for a successful prosecution.’’

Given the proliferation of computers and other electronic storage devices such as mobile phones and PDA’s, and the strong possibility that offenders have stored information relating to their offences on these devices, it is not surprising that the number of computers and other electronic storage devices seized far outweighs the availability of engineers to forensically analyse them. Storage rooms, not just in New Zealand, but the world over, are overflowing with electronic devices awaiting examination.

This backlog causes problems for detectives who want evidence quickly in order to advance their investigations and also for innocent people whose computers are seized and stored away until they can be looked at – resulting in distress and inconvenience.

EVE addresses these problems, and in common with most great inventions does this in a relatively simple but effective manner. EVE utilises a clever combination of ‘off the shelf’ commercial software and custom development to create a package which allows those investigating a case to examine a virtual representation of the device, using intuitive search tools in a way that is forensically safe and will not put any evidence contained on the system at risk.
Investigators can undertake the initial examination themselves from wherever they are in the country.

A formal examination at one of the three New Zealand laboratories will only be necessary when a more in-depth analysis is required. This effectively eliminates unnecessary delays with advantages for both investigators and the public.

From the investigator’s point of view, search tools automatically categorise items of interest, such as names, places, emails, pictures and deleted items enabling them to see at a glance whether or not the information contained on the system is of interest. EVE has the added advantage of providing a template that creates a clear and effective mechanism for presenting evidence at court.

Unsurprisingly EVE has attracted a great deal of interest internationally and the system is being looked at by the FBI, the Royal Canadian Mounted Police and the Association of Chief Police Officers (ACPO). Currently Maarten, Bill and the team at the Electronic Crime Laboratory (ECL) are working to have EVE and the ECL accredited by the American Society of Crime Laboratory Directors (ASCLD), the bench mark for Crime Laboratories.