The task of correctly identifying pornographic images in either criminal or civil investigations can be very time consuming and is often like looking for a ‘needle in a haystack’. A single case can contain thousands or even millions of images, most of which are not relevant to the investigation. Even when reviewing images in a convenient thumbnail gallery, a human can only moderate about 5000 images per hour when fatigue is taken into consideration. Therefore cases requiring image review are typically labour intensive and are often postponed; creating a backlog of cases which further compounds the issue.
Image Analyzer is a computer vision technology designed to quickly and accurately analyze images and identify pornographic content. The technology has been deployed for many years by email filtering vendors such as McAfee, Cisco, Websense and Trustwave to filter pornography from their customers email traffic. Recently it has been made available to the digital forensic community as an App in Guidance Software’s EnCase App Central to provide technology assisted review for investigations requiring the examination of images.
The technology scans in ‘real-time’ and hence does not rely on a signature database of pre-categorized content but rather utilizes multiple heuristic detection methods to reliably distinguish between previously unseen pornographic and non-pornographic images.
Other pornographic detection engines are typically overly reliant upon inaccurate ‘skin tone’ analysis, which is prone to generating false positives. Image Analyzer has relegated this element to only one minor part of a more sophisticated decision making process. This is highlighted by the ability of the technology to detect greyscale pornographic images in which no skin tones are present. Whilst Image Analyzer has not been developed to differentiate between legal and illegal imagery it will still detect images of both classifications as being pornographic.
Investigators can download both a trial and full version of Image Analyzer via App Central and install it on a machine with EnCase Forensic v7; they can then add the Image Analyzer EnPack. Once the evidence has been added to EnCase, they can select Image Analyzer from the EnScript menu.
A dialog box will appear providing the investigator with a number of different options including the ability to adjust the engine sensitivity to increase or decrease the aggressiveness of the scan.
When the scan is started Image Analyzer will analyze each image within the evidence and give it a risk score of 0-100 based on the probability that it contains human nudity. Images will be bookmarked by score based on the set thresholds either as Highly Suspect, Suspect or Clean.
Image Analyzer in EnCase can scan approximately 27,000 images per hour and on the default engine sensitivity setting it will disregard 99% of the non-pornographic content while capturing the majority of the sexually explicit images. This means overnight Image Analyzer can reduce a case containing 250,000 images to 2,500 images plus the pornographic content. The same task for a human moderator would take over 50 man-hours.
After the scan is complete the examiner can review the highly suspect image data inside EnCase using either the table or gallery view.
The examiner is now looking at the images that have the highest probability of being meaningful to their case which significantly reduces the time to discovering critical evidence.
Image Analyzer does not replace the investigator; it simply makes them more efficient and productive allowing them to spend their time on more important tasks.
The trial version of Image Analyzer can be downloaded from EnCase App Central for free.
No comments :
Post a Comment