Day 2 - Panel Discussion

1
Day 2 - Panel Discussion

• DFRWS 2004
• Linthicum, MD

2
Day 2 - Panelists

• Mr. Phil Turner, Technical Manager, Digital
  Investigation Services, QinetiQ, UK
• Mr. James Collins, AFIWC, Defensive Counter
  Information Division
• Dr. Frank Adelstein, Senior Principal Scientist,
  ATC-NYCorp
• Mr. John Ward, Senior S/W Engineer, IDEAL
  Technology Corp.

3
Day 2 - Intro

• Each question will be posed to all four
  panelists. Some questions are multi-part
• Each panelist will have 4-5 minutes to respond
• Each round will be followed by a 10 minute QA
  plenary session
• A transcript will be recorded

4
Day 2 In-Time Forensics

• Forensic analysis identifies facts or high
  confidence metrics uncovered by the application
  of known, proven, and accepted methods. These
  facts may be used to persuade or influence
  decisions across investigative domains.
• Question 1
• What do you see as the greatest challenge to the
  use and/or admissibility of forensic evidence
  collected in near-real-time or in-time
  environments?
• Question 1a
• Does the greatest risk to investigative
  credibility come from what you do or do not
  include in your real-time analysis?

5
Day 2 In-Time Forensics

• Question 2
• In your view, are methods used in
  after-the-fact digital forensic analysis
  adaptable for use in mission critical or high
  availability operations?
• If possible, generally state which ones may be
  and why.
• Question 2
• Whats the greatest technical challenge in
  applying forensic methods and capabilities from
  digital media forensics to real-time operational
  environments?
• Performance Integrity Accuracy
  Confidentiality, Repeatability of Results, etc.

6
Day 2 Topics of Consideration

• Accuracy
• Timeliness
• Adaptability
• Function
• Admissibility
• Integrity
• Focus (particular attributes)
• Performance barriers
• Collection must change
• Decision Support vs. Prosecution