In a fast-paced digital world where technology changes daily, traditional digital forensic methods need to develop at the same pace. Combine this with the pressure on already strained Law Enforcement Organisations, victims are left at continued risk, while offenders have greater opportunities to cause harm.

Years of research have resulted in Cyacomb utilising block-level hashing, moving on from the traditional method of MD5 hashing. Combining the block-level hashing with our patented Contraband Filter technology results in a simple-to-use, thorough and incredibly fast Digital Forensic Tool, finding evidence up to 100 times faster than traditional forensic methods (typically using MD5 hashing). This allows law enforcement to conduct on-scene rapid digital triage that delivers immediate results, including on deleted files, which would normally involve hours of forensic work requiring experienced/extensively trained digital forensic personnel.

So why is Cyacomb-developed technology so important?

The MD5 hash list is well known for being less secure, giving individuals the ability to find the original data online. Our technology is inherently more secure as the data held on our Contraband Filter will not and cannot allow access to the source/original data due to the format of the algorithm that facilitates block-level hash scanning. Cyacomb works with various organisations who have created their own Contraband Filters which currently sit on our Support Hub and are available to our users. Historically, most police agencies have been limited in the data they can utilise during on-scene triage, and in practice, most used a hash list usually supplied by a national agency. 

To find out more about this, please visit our “Unlocking the Best Data for CSAM Triage: Insights from ICAC” blog.

Our analysis

Working with agencies worldwide such as Project VIC, Interpol, IWF and numerous US law enforcement agencies (LEAs), including Dallas, Ventura, LAPD and Ohio, has enabled access to approximately ten major Contraband Filters. Our main findings were:

• Agencies appreciate the value of data sharing with other ICACs in investigations
• Agencies wanted a combination of using their own historical data and data from other international sources
• Half of LEAs do not routinely share data (MD5 hash lists) due to privacy concerns – more so in the UK and EU
• Bigger is not always better when looking at datasets. On average, just under one third overlap with other datasets

So why Cyacomb technology?

• Multiple Contraband Filters may be used at the same time with negligible impact on performance due to block-level hashing technology
• The ability to scan multiple media technologies, Mobiles & Tablets (including IOS and Android) alongside computers and laptops
• Higher probability of detecting content due to utilising multiple filters
• Frontline officers can use the tool without extensive digital training and receive immediate results on the ground
• The ability to scan any file type on any system where illegal files could be hidden
• Effective on Android and IOS mobile devices, allowing technology to be used across the globe where time is a limiting factor (e.g. Border Control and Registered Sex Offender Monitoring)
• Built from original data (CSAM) and (CT) material

Moving forward

The ever-increasing challenges law enforcement face to improve efficiencies are critical in modern policing.  The need to close cases, improve results, reduce costs and the number of devices seized and waiting for analysis is key.  No one wants a backlog of work!

Starting as a proof-of-concept (POC) over two years ago, Cyacomb’s Contraband Filter Hub has created the ability for LEA’s to access and share their data, increasing probability of detection from a wider pool of CSAM and CT data. To date, over 1090 Contraband Filter downloads have taken place on the platform. Detective Randall Layne of Upland PD who recently downloaded the 1000th Contraband Filter, told us that “being able to access multiple data sources using Cyacomb’s Contraband Filter technology further improves confidence”. Giving users immediate clarity and confidence is a priority at Cyacomb.

Our focus will always be based on providing simple and effective solutions to make decisions in minutes. We are always working hard to develop our technologies and versions to improve the capabilities of the tool to increase detection and provide our users the most effective solution to carry out their vital work.  

If you’re interested in learning more about how Cyacomb can streamline your digital forensics process, get in touch with us today.

If you would like to see our tools in action, request a demo today or sign up for a free 21-Day Trial to test the technology for yourself. You can also contact sales@cyacomb.com for any any other questions.