Computer 'Library' Speeds Evidence Collection

Computer forensics experts can now sift through thousands of files on a suspect's computer to find those relevant for evidence much more quickly thanks to the National Software Reference Library(NSRL), developed by computer scientists at the National Institute of Standards and Technology (NIST).

While computer forensics experts know the tricks criminals use to disguise files, they frequently face the time consuming task of searching up to 100,000 files on a single desktop computer for evidence.

Working with software manufacturers and others who provided copies of their programs, NIST has developed the National Software Reference Library. The NSRL allows law enforcement agencies to eliminate between 25 percent and 95 percent of the total files in a computer, concentrating only on those that really might contain evidence. It works by providing a verified reference data set of file "fingerprints" based on file contents rather than on other identifiers such as file name or header information.

Several federal agencies support the effort, including the National Institute of Justice, the FBI, the U.S. Customs Service, the Technical Support Working Group, and the Defense Computer Forensics Laboratory.