60 likes | 179 Views
Day 2 - Panel Discussion. DFRWS 2004 Linthicum, MD. Day 2 - Panelists. Mr. Phil Turner , Technical Manager, Digital Investigation Services, QinetiQ, UK Mr. James Collins , AFIWC, Defensive Counter Information Division Dr. Frank Adelstein , Senior Principal Scientist, ATC-NYCorp
E N D
Day 2 - Panel Discussion DFRWS 2004 Linthicum, MD
Day 2 - Panelists • Mr. Phil Turner, Technical Manager, Digital Investigation Services, QinetiQ, UK • Mr. James Collins, AFIWC, Defensive Counter Information Division • Dr. Frank Adelstein, Senior Principal Scientist, ATC-NYCorp • Mr. John Ward, Senior S/W Engineer, IDEAL Technology Corp.
Day 2 - Intro • Each question will be posed to all four panelists. Some questions are multi-part • Each panelist will have 4-5 minutes to respond • Each round will be followed by a 10 minute Q&A plenary session • A transcript will be recorded
Day 2 – “In-Time” Forensics • Forensic analysis identifies facts or high confidence metrics uncovered by the application of known, proven, and accepted methods. These facts may be used to persuade or influence decisions across investigative domains. • Question 1: • What do you see as the greatest challenge to the use and/or admissibility of forensic evidence collected in near-real-time or in-time environments? • Question 1a: • Does the greatest risk to investigative credibility come from what you do or do not include in your real-time analysis?
Day 2 – “In-Time” Forensics • Question 2: • In your view, are methods used in ‘after-the-fact” digital forensic analysis adaptable for use in mission critical or high availability operations? • If possible, generally state which ones may be and why. • Question 2: • What’s the greatest technical challenge in applying forensic methods and capabilities from digital media forensics to real-time operational environments? • Performance – Integrity – Accuracy – Confidentiality, Repeatability of Results, etc.
Day 2 – Topics of Consideration • Accuracy • Timeliness • Adaptability • Function • Admissibility • Integrity • Focus (particular attributes) • Performance barriers • Collection must change • Decision Support vs. Prosecution