A Technical History of the SEI

Digital Intelligence and Investigation Methods and Tools
The Challenge: Effective and Efficient Cyber Forensics
Traditional approaches are insufficient for investigating crimes committed through computers.
Early digital forensic tools and techniques were helpful when the amount of data stored on computers
could be examined fully; however, they became insufficient when the scope, frequency,
and complexity of cybercrimes significantly increased. As a result, federal law enforcement agencies
soon faced a backlog of digital evidence to analyze and a volume of data that could not be examined
effectively with the commercial tools available. The attacks they now investigate have become
more complex and are perpetrated by sophisticated attackers, who often use encryption and
other means to obscure their activities. Additionally, system administrators need to understand attacks
on their systems and preserve evidence in a way that holds up in court.
A Solution: Tools and Methods that Improve the State of the Practice
The SEI forensics experts develop highly specialized computer forensics and incident response
“gap area” tools and practices not addressed by commercial tools or standard techniques (see the
report by Waits [Waits 2008], for example) and provide them to the DoD and U.S. federal civilian
law enforcement agencies. Thus, the SEI equips federal law enforcement investigators to efficiently
and effectively handle cyber attacks, from collecting evidence to apprehending and convicting
the perpetrators. Because SEI forensics experts work on incidents involving national security
and assist with large-scale criminal cases, they gain the essential field experience that helps
them identify the areas that need to be addressed, and their close working relationship with law
enforcement gives them the insight they need to focus their efforts.
Because the scale of incidents and the amount of data prevents investigators from examining all
data, the SEI has identified triage strategies and automated tools for computer and data acquisition
that result in actionable information and evidence that has proven to hold up in court. Because a
criminal can commit a crime and disappear before traditional response approaches can be implemented,
the SEI identifies techniques for rapid response without jeopardizing sensitive data. The
SEI developed its first forensics support tool, Aperio, in 2004-2005. By 2012, six tools were
freely available to system administrators, with an additional four provided to law enforcement
only. 67 In addition, the SEI established and maintains a repository of Linux forensics tools 68 that
are packaged for easy download and installation by any practitioner who must acquire and analyze
data. Other SEI advances include rapid triage and correlation of malicious code and network
logs/traffic; new technologies to improve DoD investigators’ collection of intelligence from recovered
media; new methods and techniques for forensic imaging of solid state drives; and tools
for image and video analysis.
The SEI developed the CERT Clustered-Computing Analysis Platform (C-CAP), a technological
advance to address the need for forensics law enforcement analysts to work together on cases,
even if they are geographically dispersed. SEI developers integrated access to a comprehensive
array of analytical tools and resources. C-CAP is centrally managed, so platform resources can be
67 Tool descriptions can be found at http://www.sei.cmu.edu/digitalintelligence/tools
68 See http://www.cert.org/digital-intelligence/tools/linux-forensics-tools-repository.cfm
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 279
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.