MacForensicsLab Field Agent is the first and only freely available (to law enforcement) tri-platform tool designed specifically to help combat Crimes Against Children. It offers investigators a powerful yet easy to use tool with a skin tone analyzer that makes finding images of child pornography fast and easy.
The ability to quickly and effectively identify files of interest based on the percentage of skin tone contained therein makes MFL-FA an invaluable tool for law enforcement. In fact, MFL-FA was specifically designed to fill the technological gap that sexual predators have exploited for years; the lack of a fast and accurate way to identify images of evidentiary value amidst the seemingly insurmountable volume of data. Therefore, MFL-FA is perfectly suited for any Internet Crimes Against Children (ICAC) Task Force, probation and customs officers and/or any officers dealing with sexual predators. MFL-FA is the answer for all those seeking to gain the advantage over sexual predators who use technology in furtherance of their criminal acts.
Free to Law Enforcement only, Non Law Enforcement may purchase the software for US$19.95
|
To order your copy of this freeware tool please click on the "buy now" button at the bottom of this page. There is no charge whatsoever for this software but we do require the name of your agency, and some way to contact you. You will be provided a serial number for MacForensicsLab Field Agent for Windows, Mac OS X, and Linux via email. It is therefore important to ensure your email address is input correctly.
|  |
Designed for non-technical personnel, Field Agent can be run in three easy steps; there is no rebooting, troubleshooting or complex interfaces. Utilizing the computer's USB port, it can run natively on Mac OS X, Microsoft Windows, and Linux to search suspect drives and devices. By quickly providing images relevant to an investigator's interests (typically under 2 minutes), MacForensicsLab Field Agent is an invaluable tool to all law enforcement. Field Agent has the ability to export files of interest or generate an HTML report with thumbnails, path and date information of any or all files.
Typical deployment of MFL-FA is less than two minutes per machine, making it an invaluable tool for locating data of interest and increasing officer safety. Further, MFL-FA has the ability to export files of interest or generate an HTML report with thumbnails, path and date information of any or all files.
MacForensicsLab Inc. makes Field Agent freely available to all law enforcement. To acquire a serial number for MacForensicsLab Field Agent, please submit the request form (purchase order, for a zero cost purchase, no credit cards or payment required) using a law enforcement email address. Field Agent contains just a small subset of the features available in MacForensicsLab. If you like Field Agent, checkout MacForensicsLab for the most powerful cross-platform digital forensic suite available.
How to use MacForensicsLab Field Agent
Launching the Application
MacForensicsLab Field Agent (MFL-FA) is a cross platform application requiring only that you launch the particular application created for whichever operating system is being used. In this example, the Mac OS X version is being run.
Step 1: Devices
Once the application is launched and the product is registered by entering the serial number, the first pane to appear is the Devices Pane. The Devices Pane provides a list of all devices currently mounted on the system. Select a device to examine (1) and press the "Step 2: Shortcuts" button (2) to continue.
Step 2: Shortcuts
The Shortcuts Pane provides a hierarchical listing of all default folders and the user created folders contained therein of the device selected in Step 1. In this example, the Macintosh HD was selected, creating a listing of default and user created folders therein.
Select a Folder to Examine
Once the Shortcuts Pane appears, the investigator can select the device (in this case Macintosh HD) or a particular folder of interest. In this example, the User Al's Desktop folder has been selected (1). To further examine its contents, select the "Step 3: Explore" button (2).
Step 3: Explore
In this step it is possible to explore the entire contents of the directory selected, or by selecting the "Step 2: Shortcuts" button (1) move back a step to re-select.
Select a Target Folder
Upon completion of directory traversal, the investigator selects a target folder. The target folder is the folder the investigator highlights so that a SkinTone analysis can be performed against the contents of the folder. In the example the target folder is "MFL_FA_Photos" (1). Once selected, the investigator clicks on the "Step 4: Browse" button (2) to continue.
Check Parameters
Once the "Step 4: Browse" button is selected the Browse Panel appears. The Browse panel allows the investigator to set specific parameters for the search. In this example, all defaults remain. Once all the parameters are set, the investigator selects the "Browse" button (1) to begin the analysis.
Status
Once the "Browse" button has been invoked, a status window, as shown above, appears providing the investigator with the status of the current operation.
Completion
Upon completion of the analysis, a completion window appears over the results of the search. The investigator need only to select "OK" (1) to move on to reviewing the results.
Results Window
The Results Window provides the investigator with detailed information. When the investigator selects a picture by clicking on it (1), the metadata of that picture is displayed (2). Along the bottom of the image display is a slider bar (3) which is used to dynamically adjust skin tone results (15% skin tone is the default). Directly beneath the slider bar are the statistics pertaining to the number of items found (4) containing at least the amount of Skin Tone indicated in the slider bar and the total number of items (5). Upon completion of the investigator's review, the investigator can go back one step by selecting the "Step 3: Explore" button (6) or write a report by selecting the "Step 5: Write Report" button (7).
Exporting a Picture
When the investigator locates an image that he/she needs to export simply highlight the image (1) go to File -> Save (2) from the Main Menu bar (alternatively use the keyboard shortcut of "Command" + S).
Export Location
Once "Save" is selected in the previous step, a navigation window opens allowing the investigator to select the location to which the file will be saved, then click on the "Select" button.
Verifying the Export
A Folder is created in the same name of the folder from which the image was saved. Inside the folder is the image and the hash of the image.
Hash of Export
The file containing the hashes of the image includes the full path to the file, an md5, SHA1 and SHA256 hash respectively.
The Image
Lastly, the image itself resides in the newly created folder.
Additional Analysis
There are times when the investigator would like to review results other than those displayed at the default 15% skin tone. To do this, the investigator utilizes the slider bar (1) to adjust the amount of skin tone. Observe the results of 114 items in the previous example at 15% skin tone, have been reduced to only 27 items with the skin tone set to 50%. Once satisfied with the results, the investigator can select "Step 5: Write Report" (2). Note if no items are highlighted, then all items found with the defined skin tone will be written to the report.
Save the Report
When the "Step 5: Write Report" button is selected a navigation window appears. The investigator selects a location for the report to be written to and selects "Choose".
Examining the Report
Once the report is written, a browser will automatically launch displaying the HTML report. The report contains a thumbnail of all the images, the full path, size and modification date/time stamp of the file. Once completed, the investigator can simply print the report, quit the browser and quit the MFL-FA application.
Why Use MacForensicsLab Field Agent?
With ever increasing volumes of digital image and video data, the use MacForensicsLab Field Agent saves time searching for data relevant to your investigation. Timely acquisition of potential evidence can mean the difference between a conviction and a criminal walking free. MFL-FA allows advanced image searching in computer forensic investigations. Comparatively, the common use of hash sets serves to identify exact matches of images and videos but does a poor job of identifying unknown images, wherein the preponderance of potential evidence exists. MFL-FA analyzes the visual features in the image to assess its actual visual content. This means the investigator finds more vital data and decreases the likelihood that they miss critical evidence. MFL-FA's advanced skin tone technology enables investigators to quickly zero in on illicit images.
The volume of images uncovered on a suspect’s computer during a forensic investigation can take hours or even days to review. Currently, there are two means to of reviewing images; manual and hash analysis. The default install of a typical computer contains more that 10,000 images. The manual review of the default images alone can take days to complete. The method of running hash sets of known images against a computer is only effective for exact hash matches and can take vital time to complete. Displaying images containing higher contents of skin tone allows you to review those images first, where you are most likely to find files of interest, maintaining the investigative momentum.
How Does MacForensicsLab Field Agent Work?
MacForensicsLab Field Agent is a one of a kind field and lab tool that performs automated analysis of drive images, network drives, stand alone live computers, DVD’s, CD’s, and other removable media, allowing the investigator to find relevant evidence faster. MFL-FA allows the investigator to extract digital evidence in minutes, not days or weeks. It uses pixel-based image analysis technology to identify suspect images based on skin tone values. MFL-FA offers investigators immediate access to data and allows them the ability to prioritize findings. MFL-FA accommodates all user levels, not just forensic professionals; it's powerful yet user-friendly. MFL-FA helps investigators locate the presence of picture files that may contain contraband on a computer. Once the software has located images of interest, the investigator can then review the results and make the decision as to which files warrant further investigation or support the allegation(s) of child pornography.
MFL-FA allows the investigator to view a variety of graphic formats during a search and protects valuable digital evidence. This program enables investigators to identify, isolate, and store images from a suspect's computer on a thumb drive. It enables them to collect data necessary to obtain search warrants or to detain subjects pending a more comprehensive analysis. Images of interest can quickly be exported out to a flash drive or generated into a report containing information about the picture.
Skin color detection provides a gallery view sorted by skin tone content to greatly accelerate a search for traces of child pornography. It makes scanning for illicit image fast and easy. Skin tone analysis can cut the number of image files an investigator must view from tens of thousands to just a few. Furthermore, MFL-FA has a quick and easy reporting feature allowing investigator’s to display their findings in a universal format. In summary, MFL-FA cuts time spent on a case and increases the likelihood of a timely conviction.
