TSA wants to capture evidence on hard drives more efficiently

DeepSpar's imaging system

Fed up with its current forensic imaging system, which is designed to gather evidence from computer hard drives, TSA’s digital forensic lab is planning to purchase a state-of-the-art “CD / DVD / Blu-Ray Publishing / Evidence Forensic Imaging System” that will enable it to work on several evidence-gathering projects simultaneously, with a lot fewer headaches.

“The device currently in use cannot automatically span data to multiple discs if a data set is larger than the size of a DVD,” explains a TSA statement of work released on July 9. “It is not network capable so only one user can archive data at a time. Only one recorder is available which makes archiving data sets a lengthy process.”

To overcome these limitations, TSA has issued a solicitation to procure one forensic imaging systems, 40 “media and ribbon” set intended for the Blu-Ray technology, two media and ribbon set intended for DVDs, 2,000 DVDs, 2,000 Blu-Ray discs, and five years of on-site technical support.

The imaging system that TSA wants must be able to work with forensic tools such as FTK or Encase, says the statement of work. “It must perform MD5 and SHA-1 file hashing which are standard hashing algorithms in forensic imaging,” the SOW continues.

TSA says its forensics lab processes an average of 500GB of data on a monthly basis. As a result, the lab requires “a system that can automatically archive large amounts of data with minimal human intervention,” says the SOW.

Problems that often arise in capturing data from hard drives are well known in the industry.

“As a forensic data recovery professional, you know how important it is to work from an accurate, stable hard drive image,” explains one supplier of forensic imaging systems, DeepStar, on its Web site. “Unfortunately, traditional disk imaging tools and methods are designed to deal with intact hard drives, not the unstable ones with bad sectors that are your stock-in-trade. Drives stop responding, disks degrade or fail under intensive reading, valuable files remain locked in bad sectors.”

The solicitation issued by TSA is for a small business set-aside contract. Prospective vendors are required to submit their bids by July 15.

Further information is available from Ali Etedali, a contract specialist, at 571-227-2516 or ali.etedali@dhs.gov.