Last week, we announced the next step in our comprehensive case management solution – Lima 2.3. This update will bring with it a multitude of functional and performance upgrades, the first upgrade promises to significantly change the way that evidence handling is managed in digital forensic laboratories across the world, and this second upgrade is no different. Introducing the Knowledge Base Look-Up feature.
IntaForensics have formulated a unique Knowledge Base Lookup feature directly in to the evidence processing forms to improve the efficiency of the Pre-Imaging process. When entering Pre-Imaging details for Exhibits in Lima, all relevant Knowledge Base articles which contain the keywords will generate at the foot of the data entry form. The Knowledge Base articles can be accessed directly from the Pre-Imaging form through Lima’s improved intuitive thinking. These are contextual articles, yet not disruptive to analysts’ workflow.
Assisting Experts
Every time an analyst believes they are up-to-date on the latest handsets or laptops and how to analyse them, more and more are being released. While it important to stay up to date, it is essential that best practice knowledge is stored and utilized correctly. The new Knowledge Base Look-Up feature will allow analysts to enter the digital forensic process with background knowledge, a form of ‘heads up’, on the laptop or mobile device they will imminently examine. The feature is highly intuitive, becoming an active ‘Look-Up’ for relevant articles based when an analyst comes to analysing a new device. Using Lima’s Advanced Search capabilities, an analyst can enter as little as the model of the mobile phone before being presented with rich content drawn directly from the clients Knowledge Base. If your digital forensic laboratory is performing a large volume of investigations then over time your knowledge base will expand for a multitude of different device models – making it easier for your colleagues performing similar investigations in the future.
Organizational Improvement
Ultimately this is the next stage in our knowledge sharing platform for analysts, to share their expertise between each other to improve the efficiency within their forensic laboratory. It provides a sense of reassurance for analysts when carrying out an investigation on a model which they may not be confident or experienced with. More importantly, the article could advise against certain techniques which they know from experience could damage the device or the data stored within it. By improving the ability to share vital information, organizations can quickly streamline their mobile phone forensic processes which, in turn, saves time and money.
Utilising the Feature
The real strength is in Lima’s ability to quickly share knowledge. Come across a new mobile? Sharing experience with a handset to the knowledge base can be vital for future investigations.
At the beginning of the pre-imaging process, the system will not present any articles. As analysts start to populate the ‘Pre-Imaging Exhibit Details’, the Look-Up proceeds to search and scan the Knowledge Base. As you can see by the screenshot, the ‘Manufacturer’ has generated a ‘Number of Related articles’. In this case there are 9 relevant articles that have been flagged up by either the manufacturer, in this case – Apple, or the Model, being ‘Samsung S7’. At this point the forensic analyst can select the Related Articles button to immediately view useful articles in the knowledge base.
The matched results will be highlighted throughout the document. In this example, the iOS 8 article that has been selected the initial keyword search was ‘Apple’. This particular article could prove to be helpful for a variety of different types of Apple iPhones with iOS 8 installed.
If you find an article which looks of interest to your forensic investigation then there is an option to ‘View Document’.
After selecting ‘View Document’, the document will open up in Lima where it can be viewed in full, with the option to print.
Intuitive and Intelligent
Ultimately this new feature is perfect for improving efficiency in the lab. Not only does it save time for analysts working on unfamiliar devices and safeguards against potential errors, but it is intuitive and intelligent. The key element of this feature is the ability to ‘Look-up’ within the knowledge base as opposed to just having a list of the relevant articles in the knowledge base.
How do I get Look-Up?
Our Lima 2.3 update will be coming this May and will be available for all Lima Personal, Laboratory and Enterprise clients. With the release of our Lima Support Portal, getting Lima 2.3 will be the most simple and accessible Lima update so far. Simply navigate to the Downloads section, where the update will be available.
Stay tuned for next weeks ‘sneak peak’ into another upcoming feature to expect from the Lima 2.3 update.