A Technical History of the SEI

In supporting law enforcement cases, the SEI identified gap areas not addressed by commercial
tools or commonly used techniques. With the goal of preserving evidence and presenting it in a
way that leads to the apprehension of the criminals, the SEI developed tools, analysis methods,
and processes that enable comprehensive and efficient analysis of evidence for use in cybercrime
cases.
Cases involve large amounts of data and important volatile data. As a first step toward addressing
the need to extract and understand the data quickly, the SEI developed the CERT LiveView tool. 63
To deal with the increasing use of strong encryption of data on seized computers, the SEI is developing
ways to adapt the data acquisition process and recover encrypted data. SEI-developed technologies,
tools, and practices have resulted in previously unattainable results for national and international
cybercrime investigations. As a major advance, the Department of Justice influenced
the federal government to accept evidence from SEI technology as being admissible in court
cases.
By continuing to provide operational support to high-profile intrusion, identity theft, and general
computer crime investigations, the SEI is able to see the changing limitations of computer forensics
and incident response in the field first-hand. Combining this applied research with the talents,
operational experience, research capabilities, and the extensive knowledge base of Carnegie
Mellon University, the SEI will remain unmatched in its ability to develop new tools and methods
to address cybersecurity limitations and critical gaps.
Influence on the State of the Practice
The continuing SEI digital intelligence and investigation advances are used primarily by law enforcement.
In addition, the SEI makes some tools available to system administrators through the
web. 64 With the SEI tools and techniques, system administrators can identify malicious activity and
establish a chain of evidence. As a result, criminals may be stopped before they cause more damage.
To increase the government’s capability to deal with attacks, the SEI provides training to federal,
state, local, and international law enforcement agencies in the use of its tools and techniques. The
staff also teaches an SEI course on forensic response and analysis 65 and presents courses in the
Cyber Forensics and Digital Response track at Carnegie Mellon’s Information Networking Institute
(INI), which offers certification in digital forensics. 66 The CERT STEPfwd training environment includes
demonstrations that show how to use some of the SEI-developed digital investigation tools.
Keeping Up with Changes in Cybercrime
Now the SEI assists in the pursuit of cybercriminals and develops tools and methods that both
prevent and combat cybercrime. Future research and development will enable the SEI to keep up
with changing technology, risks, attacks, and federal law enforcement and incident responders’
needs. Operational support will help ensure that the SEI is focusing on essential gap areas. The
63 See http://liveview.sourceforge.net
64 See http://www.sei.cmu.edu/digitalintelligence/tools
65 A course description can be found at http://www.sei.cmu.edu/training/P103.cfm
66 For information about INI, and its Pittsburgh programs in particular, see http://www.ini.cmu.edu
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 274
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.