Smarter enhances police investigations with rapid digital forensics
Mobile phones, computers, tablets and other devices can provide crucial evidence in police investigations. But given ongoing increases in device storage capacity, data volumes, and the number of devices seized, effective law enforcement depends on having enough computing power to process this mountain of evidence. Collaborating with Lenovo, Blue Lights Digital set out to demonstrate the performance and efficiency benefits of using Lenovo ThinkStation P620 workstations for digital forensics—helping police forces to source hardware with a proven ability to enhance their operations.
A leader in digital investigations, Blue Lights Digital has decades of experience assisting private businesses, law enforcement, and intelligence agencies with their digital operations. As well as conducting its own private investigations for corporate clients and individuals, Blue Lights Digital helps security professionals, military personnel, and law enforcement strengthen their investigative capabilities with cutting-edge digital forensics tools and training.
Evolving landscape
In today’s technology-driven world, almost every crime committed will generate some form of digital evidence. As a result, having the capability to analyze computers, mobile phones, tablets and other common devices quickly is an essential element in uncovering clues and bringing criminals to justice.
With technology evolving at pace, police forces must adapt their approaches, develop their skills and ensure they have the right tools at hand to be able to carry out effective forensic investigations.
Nick Curry, COO at Blue Lights Digital explains: “The amount of data the police need to process when carrying out routine digital forensic analysis has rapidly increased in recent years. To put this into perspective, if you were to print out all of the data from a mobile phone with a 256 gigabyte storage capacity in size 10 font, the paper would easily fill two 40 foot shipping containers. Today, it is very common for witnesses and suspects to possess multiple devices with memory capacities of up to one terabyte. Ultimately, the need to process more data faster places additional pressure on already strained police forces.”
Many investigations by law enforcement agencies are timesensitive. In some cases, uncovering evidence from a seized device quickly can make all the difference in a life-and-death scenario.
Paul Cook, Digital Forensic Lead and Technical Service Officer at Blue Lights Digital, comments: “With police resources already stretched, very few forces have the luxury of being able to set aside the time to keep up to date with the latest developments in the back-end hardware powering their digital forensics solutions. Often, when it comes to refreshing their capabilities, police forces fall into the trap of sticking with the status quo—potentially missing out on IT infrastructure that would transform their digital forensics operations.”
“I have worked with Digital Forensic Units for about 8 years, so when we announced the P620 last year, I knew that it would accelerate these key workflows.” says Paul Sansbury, Workstation Specialist, Public Sector. “Working with Blue Lights Digital, we have clearly quantified this performance increase and I couldn’t be happier with the results. The support from BLD and their forensics practitioner have been pivotal in proving my initial belief.”
Eager to help police forces improve their digital forensics capabilities, Blue Lights Digital set out to enable decision makers in law enforcement to better evaluate and understand the benefits of different hardware offerings.
Real-world testing, next-gen hardware
Following a successful collaboration with Blue Lights Digital, Lenovo approached the company with a new proposal. The aim: evaluate how a Lenovo ThinkStation P620 would perform when running leading forensic software.
“We were keen to help Lenovo prove the value of their hardware, and we had the skills in-house to be able to objectively measure the performance of a Lenovo ThinkStation P620 running specialist software,” explains Nick Curry. “Many of our experts are security-cleared former police officers and digital forensics experts with experience running leading forensics programs in the field. By drawing on this unique knowledge base, we could put the Lenovo hardware through its paces and mimic the way it would be used by law enforcement on a day-to-day basis.”
To test the versatility of the ThinkStation P620, Blue Lights Digital benchmarked performance while running a variety of the most widely used digital forensics software packages in the world, including AccessData Forensics ToolKit, ADF solutions, Cellebrite UFED, Griffeye and HancomWITH.
The Lenovo ThinkStation P620 stood a strong chance of taking the lead from the benchmark machine.
Paul Cook comments: “As well as measuring the performance of the Lenovo ThinkStation P620 workstation running digital forensics solutions, we also benchmarked the Lenovo hardware against the workstation most commonly used in the digital forensics field. This way, we could provide law enforcement with a set of objective data illustrating the benefits of using a Lenovo machine compared against existing models.”
Unlocking efficiency
From its initial benchmarking activities, Blue Lights Digital discovered that a Lenovo ThinkStation P620 can deliver significant performance advantages compared to the current benchmark dual-processor workstation.
“We were impressed with just how performant and powerful the Lenovo ThinkStation P620 is,” reflects Nick Curry. “Overall, we measured that Lenovo hardware offered a 25 percent boost in efficiency when recovering data from a variety of devices using industry-recognised forensics software. If police forces were able to achieve this level of efficiency in their operations, they could accelerate the discovery of key evidence, which is especially critical in time-sensitive cases.”
When compared with the industry-recognised 24-core workstation, Blue Lights Digital found that a Lenovo ThinkStation P620 could conduct forensic capture analysis on an Android Poco device using HandcomWITH over 24 percent faster. Using the same software, the Lenovo workstation also accelerated analysis on an iPhone 12 device by 41 percent.
Blue Lights Digital discovered that a Lenovo ThinkStation P620 workstation delivered impressive performance improvements when recovering data from other devices, too. For instance, using ADF solutions on the Lenovo workstation, time to conduct forensic analysis on a device running Mac OSX was reduced by 27 percent. Similarly, running Griffeye software, image analysis on a Windows device was 37 percent faster compared with the industry-recognised architecture.
Paul Cook adds: “If a police force were to deploy four Lenovo ThinkStation P620s, we’ve calculated that they would see the same boost in efficiency as they would by hiring an additional digital forensics officer. With many forces looking for ways to optimize their resources, achieving efficiency improvements of this magnitude will go a long way to helping them strengthen their operations while ensuring value for taxpayers. Ultimately, empowering law enforcement to increase productivity and efficiency will help to bring more criminals to justice and keep law-abiding citizens safe.”
* Data provided by Blue Lights Digital.
If a police force were to deploy four Lenovo ThinkStation P620 workstations, we’ve calculated that they would see the same boost in efficiency as they would by hiring an additional digital forensics officer.
Paul Cook, Digital Forensic Lead and Technical Service Officer at Blue Lights Digital
